blackmoon | fafc285a50575732d92759e3a86f52e69f83fca43a342b0aaa11c0612606305d

Sharing

Copy URL Twitter E-mail

General

Target

fafc285a50575732d92759e3a86f52e69f83fca43a342b0aaa11c0612606305d
Size

4.6MB
MD5

c16c84ed0245a2e0dd93a40034f396e3
SHA1

72c6f86e0908f3ece1187afc6d79c46f184a55bf
SHA256

fafc285a50575732d92759e3a86f52e69f83fca43a342b0aaa11c0612606305d
SHA512

2e2ae98f8c53d920f5d4603077454041515eff0f4168a2ebfa6d1a88975d6d666c74278c51a5812c364949c91a8aa27e376565da242c89aa8fc944cbd4bed36a
SSDEEP

49152:hh9g+YNAzmp5vyHiNcrBbGna776++h2NSbDenhF2Lo+:G+YRHWiaByna7ebDuFx+

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fafc285a50575732d92759e3a86f52e69f83fca43a342b0aaa11c0612606305d

Files

fafc285a50575732d92759e3a86f52e69f83fca43a342b0aaa11c0612606305d
.dll windows x86

e22989fce24046e514142a42ea6aadde

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSAStartup
inet_ntoa
WSACleanup
accept
listen
bind
htons
getsockname
ioctlsocket
socket
closesocket
connect
inet_addr
__WSAFDIsSet
select
recv
send
ntohs
shutdown
htonl
gethostname
WSAGetLastError
gethostbyname

kernel32

GetTempPathA
GetVersionExA
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
LoadLibraryA
FreeLibrary
GetCommandLineA
GetPrivateProfileStringA
LCMapStringA
FindFirstFileA
SetFilePointer
SetEndOfFile
SetFileAttributesA
GetLocalTime
GetTickCount
GetEnvironmentVariableA
FormatMessageA
GetUserDefaultLCID
GetFileSize
ReadFile
WritePrivateProfileStringA
HeapReAlloc
ExitProcess
IsBadStringPtrA
LocalSize
GlobalSize
TerminateThread
QueryDosDeviceW
CreateProcessA
lstrcpyA
VirtualQueryEx
SetPriorityClass
OpenProcess
GetCurrentProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
IsBadReadPtr
CreateFileMappingA
FindClose
FindFirstFileW
WriteFile
CreateFileW
CreateThread
GetCurrentThreadId
DeleteFileA
LocalFree
CreateDirectoryW
LocalAlloc
lstrlenW
Sleep
GetExitCodeThread
ReadProcessMemory
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
RtlMoveMemory
GetComputerNameA
GetVolumeInformationA
DeviceIoControl
lstrcpyn
CreateFileA
CreateEventA
OpenEventA
SetWaitableTimer
CreateWaitableTimerW
HeapFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
VirtualFree
VirtualAlloc
CloseHandle
TerminateProcess
GetWindowsDirectoryA
WideCharToMultiByte
HeapAlloc
GetModuleFileNameA
VirtualQuery
GetModuleHandleA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
MultiByteToWideChar
GetNativeSystemInfo
GetModuleHandleW
GetProcessHeap
lstrlenA
InterlockedExchange
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
LCMapStringW
UnhandledExceptionFilter
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetACP
HeapSize
RaiseException
GetSystemTime
ExitThread
RtlUnwind
GetOEMCP
GetCPInfo
GetProcessVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalFlags
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
lstrcpynA
FlushFileBuffers
InterlockedDecrement
InterlockedIncrement
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
MulDiv
GetVersion
GetTimeZoneInformation
GetProcAddress
DeleteCriticalSection
GetSystemDirectoryA
SetLastError
lstrcatA
GetLastError

user32

LoadCursorW
SetClipboardData
CloseClipboard
LookupIconIdFromDirectoryEx
CreateIconFromResourceEx
RegisterClassExW
DefWindowProcW
SystemParametersInfoA
MessageBoxTimeoutA
CopyImage
MsgWaitForMultipleObjects
CreateWindowExW
SendMessageW
GetClassNameW
EmptyClipboard
OpenClipboard
PeekMessageA
GetMessageA
SetForegroundWindow
SetWindowPos
CallWindowProcA
ShowWindow
IsWindowVisible
FindWindowExA
GetForegroundWindow
GetDesktopWindow
GetWindow
GetClassNameA
GetWindowTextLengthA
DispatchMessageA
wsprintfA
SetClassLongA
GetClassLongA
SetRect
MessageBoxA
SetWindowTextA
EnableWindow
IsWindowEnabled
GetWindowTextA
IsWindow
GetWindowRect
MoveWindow
SetActiveWindow
MessageBeep
GetPropA
GetMessageW
TranslateMessage
DispatchMessageW
RemovePropA
PostMessageW
SetTimer
GetAsyncKeyState
DestroyWindow
GetWindowThreadProcessId
CreatePopupMenu
AppendMenuA
TrackPopupMenuEx
DestroyMenu
SetCursor
SendMessageA
KillTimer
IntersectRect
InvalidateRect
UpdateLayeredWindow
ReleaseCapture
LoadCursorFromFileW
IsZoomed
IsIconic
PtInRect
SetParent
PostMessageA
UpdateWindow
ValidateRect
GetSystemMetrics
GetWindowTextW
SetWindowRgn
ReleaseDC
SetCaretPos
GetCursorPos
CallWindowProcW
TrackMouseEvent
GetClientRect
GetDlgItem
GetWindowLongA
CreateWindowExA
DestroyCursor
SetWindowLongA
LoadCursorA
ScreenToClient
GetSysColor
LoadBitmapA
RegisterHotKey
UnregisterHotKey
GetActiveWindow
PostQuitMessage
GetLastActivePopup
SetWindowsHookExA
CallNextHookEx
GetKeyState
GetNextDlgTabItem
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
ClientToScreen
TabbedTextOutA
DrawTextA
GrayStringA
UnhookWindowsHookEx
CreateDialogIndirectParamA
EndDialog
UnregisterClassA
GetDlgCtrlID
GetMenuItemCount
SendDlgItemMessageA
IsDialogMessageA
GetWindowPlacement
RegisterWindowMessageA
GetMessagePos
GetMessageTime
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetParent
AdjustWindowRectEx
MapWindowPoints
LoadIconA
GetSysColorBrush
LoadStringA
PostThreadMessageA
GetClassLongW
SetPropA
SetWindowLongW
SetFocus
GetDC
DefMDIChildProcA
GetFocus
BeginPaint
EndPaint
SetCapture
DefWindowProcA

shlwapi

PathFindExtensionA
PathFileExistsA
PathIsDirectoryW
StrToIntExA
PathFindFileNameA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

gdi32

OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
SelectObject
SetMapMode
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
DeleteObject
DeleteDC
GetDeviceCaps
CreateRoundRectRgn
CreateRectRgn
GetDIBits
SetTextColor
RestoreDC
SaveDC
CreateBitmap
TranslateCharsetInfo
BitBlt
CreateCompatibleDC
CreateDIBSection
SetBkMode
SetBkColor
GetStockObject
GetObjectA
ExtCreateRegion
CombineRgn
CreateSolidBrush
CreateFontA
SetViewportOrgEx

comdlg32

GetOpenFileNameA
ChooseColorA

advapi32

RegSetValueExA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey

shell32

DragAcceptFiles
DragFinish
DragQueryFileA
Shell_NotifyIconW
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA
SHGetSpecialFolderPathA

ole32

OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CLSIDFromString
StringFromGUID2
CLSIDFromProgID
CoCreateInstance
CoRevokeClassObject
OleRun

wininet

InternetConnectA
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
HttpQueryInfoA
InternetSetOptionA
InternetOpenA

gdiplus

GdipImageSelectActiveFrame
GdipCreateHBITMAPFromBitmap
GdipGetCompositingQuality
GdiplusStartup
GdipCreateImageAttributes
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipCreatePathGradientFromPath
GdipDrawPolygon
GdipFillPolygon
GdipCreatePen2
GdipDeleteFont
GdipGetFamilyName
GdipGetFontSize
GdipGetFontStyle
GdipMeasureString
GdipGetImagePixelFormat
GdipCloneBitmapArea
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRectRect
GdipDisposeImage
GdipSetClipRegion
GdipSetClipRect
GdipDrawRectangle
GdipDeletePen
GdipSetPenDashStyle
GdipResetClip
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipCreateStringFormat
GdipSetStringFormatHotkeyPrefix
GdipDeleteStringFormat
GdipGraphicsClear
GdipCreateLineBrushFromRect
GdipFillRectangle
GdipDeleteBrush
GdipGetFontHeight
GdipCreateSolidFill
GdipDrawString
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipSetCompositingQuality
GdipSetInterpolationMode
GdipSetStringFormatAlign
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipGetStringFormatAlign
GdipGetStringFormatTrimming
GdipCreateLineBrush
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImageRect
GdipGetStringFormatFlags
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipLoadImageFromStream
GdipSaveImageToStream
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipSetStringFormatMeasurableCharacterRanges
GdipCreateRegion
GdipMeasureCharacterRanges
GdipGetRegionBounds
GdipFillPath
GdipClosePathFigure
GdipAddPathArc
GdipCreatePath
GdipDeletePath
GdipDrawPath
GdipCreateRegionHrgn
GdipDeleteRegion

oleaut32

VariantInit
VariantChangeType
SysFreeString
SafeArrayCreate
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
SafeArrayAllocDescriptor
VarR8FromCy
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
OleLoadPicture
SafeArrayAllocData
SafeArrayDestroy
VariantCopy
SysAllocString
VariantClear
VarR8FromBool
SafeArrayGetDim

psapi

GetModuleFileNameExA
GetProcessImageFileNameW

atl

ord42

imm32

ImmAssociateContext
ImmGetContext

iphlpapi

GetAdaptersInfo

oledlg

ord8

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

comctl32

ImageList_Add
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_EndDrag
ord17
ImageList_BeginDrag

Exports

Exports

Happy

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.2MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 108KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e22989fce24046e514142a42ea6aadde

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

shlwapi

version

gdi32

comdlg32

advapi32

shell32

ole32

wininet

gdiplus

oleaut32

psapi

atl

imm32

iphlpapi

oledlg

winspool.drv

comctl32

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 36KB - Virtual size: 32KB

.data Size: 2.2MB - Virtual size: 2.4MB

.rsrc Size: 4KB - Virtual size: 828B

.reloc Size: 108KB - Virtual size: 105KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 36KB - Virtual size: 32KB

.data
Size: 2.2MB - Virtual size: 2.4MB

.rsrc
Size: 4KB - Virtual size: 828B

.reloc
Size: 108KB - Virtual size: 105KB