blackmoon | 520b779c59a28a69f2d1cf0e9f132f8218ed988bf102c52468e5f26416054ca5

Sharing

Copy URL Twitter E-mail

General

Target

520b779c59a28a69f2d1cf0e9f132f8218ed988bf102c52468e5f26416054ca5
Size

980KB
MD5

437fd4c11fc1a09e19ef99fad8f51f8a
SHA1

93165f8a866dd9b877e4e0071f33590c579106b5
SHA256

520b779c59a28a69f2d1cf0e9f132f8218ed988bf102c52468e5f26416054ca5
SHA512

fdb6c6d1b6cba50bb8a63cf16474d2da3603b0ce59dfc1a96806a1525069605c8fa0d4bcc6e0283c2f0606bf0e661f9f2bd0b7dde0842f64bf9d1d94c9f7bca3
SSDEEP

24576:Aagl9nCPk1VynNJf7uVEqQ3Ow8SViwkjo9JnA/5uNZypcBK/Vx4rjuPdqF/FmZCL:AuPk1GArXYyjIZl

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
520b779c59a28a69f2d1cf0e9f132f8218ed988bf102c52468e5f26416054ca5

Files

520b779c59a28a69f2d1cf0e9f132f8218ed988bf102c52468e5f26416054ca5
.dll windows x86

67bff2174017bf65b00aaad2692c0209

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetCommandLineA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetUserDefaultLCID
WideCharToMultiByte
MultiByteToWideChar
GetFileSize
ReadFile
LCMapStringA
WriteFile
GetPrivateProfileStringA
GetModuleFileNameA
HeapReAlloc
ExitProcess
IsBadCodePtr
VirtualFreeEx
SetStdHandle
SetUnhandledExceptionFilter
LCMapStringW
GetStringTypeW
GetStringTypeA
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
FreeLibrary
GetProcAddress
LoadLibraryExA
LocalSize
HeapFree
GetModuleHandleA
GetTickCount
TerminateProcess
CreateFileMappingA
RtlMoveMemory
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
IsBadReadPtr
HeapAlloc
GetProcessHeap
lstrlenA
SetWaitableTimer
CreateWaitableTimerA
VirtualProtect
CreateThread
CloseHandle
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetACP
HeapSize
RaiseException
RtlUnwind
DeviceIoControl
CreateFileA
GetOEMCP
GetCPInfo
FlushFileBuffers
SetFilePointer
GetCurrentProcess
GetProcessVersion
FindResourceA
LoadResource
LockResource
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GetLastError
SetLastError
InterlockedIncrement
WritePrivateProfileStringA
GlobalFlags
MulDiv
GetVersion
lstrcpynA
lstrcpyA
lstrcatA
SetErrorMode
InterlockedDecrement
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateThread
Sleep
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
LocalAlloc
LocalFree
TlsAlloc

user32

GetClassNameA
GetWindowTextLengthA
GetWindowTextA
MapVirtualKeyA
GetParent
SendInput
mouse_event
GetDoubleClickTime
BeginPaint
EndPaint
CallWindowProcA
GetAsyncKeyState
GetClientRect
GetWindowThreadProcessId
IsWindowVisible
MessageBoxTimeoutA
MsgWaitForMultipleObjects
keybd_event
PeekMessageA
wsprintfA
SetMenuDefaultItem
SetMenuItemBitmaps
SetMenuItemInfoA
CheckMenuItem
RemoveMenu
MenuItemFromPoint
GetMenuDefaultItem
GetMenuInfo
GetMenuState
GetMenuItemRect
GetMenuItemInfoA
GetMenuStringA
TrackPopupMenu
SetForegroundWindow
CheckMenuRadioItem
GetMenuItemID
GetSubMenu
SetMenuInfo
InsertMenuA
GetMenuItemCount
AppendMenuA
DestroyMenu
LoadMenuA
GetSystemMenu
DestroyWindow
DefWindowProcA
SendMessageA
DefMDIChildProcA
LoadCursorA
SetCursor
TrackMouseEvent
DestroyIcon
PostQuitMessage
SetWindowLongA
DestroyCursor
CreateWindowExA
GetWindowLongA
GetDlgItem
IsWindow
SetFocus
GetFocus
GetWindowRect
ScreenToClient
InvalidateRect
ValidateRect
UpdateWindow
MoveWindow
SetWindowPos
PostMessageA
GetLastActivePopup
SetWindowsHookExA
GetCursorPos
CallNextHookEx
GetKeyState
GetActiveWindow
GetNextDlgTabItem
EnableMenuItem
ModifyMenuA
LoadBitmapA
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
UnhookWindowsHookEx
UnregisterClassA
PtInRect
GetDlgCtrlID
GetWindow
ClientToScreen
GetDC
ReleaseDC
TabbedTextOutA
DrawTextA
GrayStringA
SendDlgItemMessageA
GetWindowPlacement
SystemParametersInfoA
GetForegroundWindow
GetMessagePos
GetMessageTime
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
MapWindowPoints
LoadIconA
GetSysColorBrush
LoadStringA
PostThreadMessageA
CreateDialogIndirectParamA
EndDialog
CreatePopupMenu
CreateMenu
KillTimer
SetTimer
RegisterClassExA
SetActiveWindow
DispatchMessageA
TranslateMessage
IsDialogMessageA
TranslateAcceleratorA
GetMessageA
UnregisterHotKey
RegisterHotKey
RegisterWindowMessageA
DrawMenuBar
SetMenu
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
GetSysColor
FillRect
SetClassLongA
GetClassLongA
SetRect
SetWindowRgn
RemovePropA
GetPropA
SetPropA
MessageBoxA
SetWindowTextA
EnableWindow
IsWindowEnabled
ShowWindow
SetParent

gdi32

DeleteObject
CreateBitmap
SaveDC
RestoreDC
CreateCompatibleDC
GetStockObject
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
GetObjectA
CreateDIBSection
DeleteDC
SelectObject
BitBlt
ExtCreateRegion
CombineRgn
CreateRoundRectRgn
StretchBlt
CreateSolidBrush
CreatePatternBrush
SetBkColor
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps

advapi32

RegCloseKey
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA

shell32

DragFinish
Shell_NotifyIconA
DragAcceptFiles
DragQueryFileA

ole32

CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleRun
CoUninitialize
CoInitialize
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard

wininet

InternetConnectA
InternetCloseHandle
InternetTimeToSystemTime
HttpQueryInfoA
InternetReadFile
HttpSendRequestA
InternetSetOptionA
HttpOpenRequestA
InternetOpenA

atl

ord42

oledlg

ord8

oleaut32

VarR8FromCy
VarR8FromBool
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SafeArrayCreate
SysFreeString
VariantChangeType
VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayDestroy
VariantCopy
SysAllocString
VariantClear
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize

ws2_32

closesocket
select
__WSAFDIsSet
send
htons
WSACleanup
gethostbyname
recv
shutdown
connect
inet_addr
socket
inet_ntoa
WSAStartup
WSAGetLastError
ioctlsocket

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

comctl32

ord17

Exports

Exports

KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode

Sections

.text
Size: 880KB - Virtual size: 877KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

67bff2174017bf65b00aaad2692c0209

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

wininet

atl

oledlg

oleaut32

ws2_32

winspool.drv

comctl32

Exports

Exports

Sections

.text Size: 880KB - Virtual size: 877KB

.rdata Size: 24KB - Virtual size: 22KB

.data Size: 28KB - Virtual size: 110KB

.rsrc Size: 4KB - Virtual size: 816B

.reloc Size: 40KB - Virtual size: 37KB

.text
Size: 880KB - Virtual size: 877KB

.rdata
Size: 24KB - Virtual size: 22KB

.data
Size: 28KB - Virtual size: 110KB

.rsrc
Size: 4KB - Virtual size: 816B

.reloc
Size: 40KB - Virtual size: 37KB