blackmoon | 07f91bda143862611ca33d6a59fbe567cf3ca172009de11f4fdaa17176eb15e0

Sharing

Copy URL

Twitter E-mail

General

Target

07f91bda143862611ca33d6a59fbe567cf3ca172009de11f4fdaa17176eb15e0
Size

2.7MB
MD5

8c769daf1698222d73573138e684e914
SHA1

cee2926d2fca46b9d62fffd46eb45e3660f32469
SHA256

07f91bda143862611ca33d6a59fbe567cf3ca172009de11f4fdaa17176eb15e0
SHA512

c0749663159ae708047860c812c80d5bf012c66157a379c8018f6f79cdba8f7246cc1c6a31e0000fc2853a5988512bbb651c27564039679b710a0a462baca9a9
SSDEEP

24576:6odL1v7+oZx/kXEG9B1bxPT9n61BG0JwWEjLcbUHwFnGctRajPz5/gmknnvnPIbQ:HdLsoZgjc/wWEczFnmNO+8Uz4hj

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
07f91bda143862611ca33d6a59fbe567cf3ca172009de11f4fdaa17176eb15e0

Files

07f91bda143862611ca33d6a59fbe567cf3ca172009de11f4fdaa17176eb15e0
.exe windows x86

7773cdbeb5bd1415e972f50daa8484e2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FormatMessageA
LoadLibraryExA
FreeLibrary
LCMapStringA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalSize
GlobalFree
RtlFillMemory
CreateMutexA
ReleaseMutex
OpenMutexA
HeapFree
DebugActiveProcess
CreateEventA
GetShortPathNameA
WriteFile
SetFilePointer
SetEndOfFile
CopyFileA
GetDateFormatA
GetTimeFormatA
DeleteFileA
MoveFileA
GetThreadContext
Module32First
OpenProcess
WriteProcessMemory
GetModuleHandleA
GetProcAddress
CreateFileA
Sleep
GetVersion
VirtualProtectEx
SetProcessWorkingSetSize
GetCurrentProcessId
VirtualQueryEx
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCurrentThread
GetProcessTimes
GetLastError
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
GetModuleFileNameA
Module32Next
LocalFree
LocalAlloc
TerminateThread
TerminateProcess
FileTimeToSystemTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
IsBadWritePtr
LCMapStringW
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStdHandle
SetHandleCount
GetFileType
SetStdHandle
HeapSize
GetACP
GetSystemTime
RaiseException
RtlUnwind
GetOEMCP
GetCPInfo
GetProcessVersion
FindResourceA
GetExitCodeThread
VirtualFreeEx
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
GetCurrentProcess
GetExitCodeProcess
ReadFile
PeekNamedPipe
CreateProcessA
CreatePipe
GetComputerNameA
GetVersionExA
GetVolumeInformationA
DeviceIoControl
WritePrivateProfileStringA
UnmapViewOfFile
SetFileAttributesA
GetFileAttributesA
GetCurrentDirectoryA
SetLocalTime
GetStartupInfoA
SetThreadContext
InterlockedIncrement
GetUserDefaultLCID
CreateDirectoryA
FindFirstFileA
RemoveDirectoryA
FindNextFileA
FindClose
GetFileSize
GetTickCount
IsBadReadPtr
LoadResource
LockResource
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalFlags
GetLocalTime
GetThreadTimes
ResumeThread
SuspendThread
OpenThread
RtlMoveMemory
IsDBCSLeadByteEx
HeapReAlloc
lstrlenA
GetCurrentThreadId
ReadProcessMemory
MultiByteToWideChar
VirtualAllocEx
CreateThread
SetWaitableTimer
CreateWaitableTimerA
InterlockedDecrement
GetCommandLineA
OpenEventA
Thread32Next
Thread32First
WaitForSingleObject
CreateRemoteThread
MulDiv
lstrcatA
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
FlushFileBuffers
lstrcpyA
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
SetLastError
GetTimeZoneInformation
IsDebuggerPresent
GetProcessHeap
HeapAlloc
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
WideCharToMultiByte
ExitProcess
VirtualFree
LoadLibraryA
lstrcpyn
VirtualAlloc
lstrcpynA
GetLongPathNameA
ReleaseSemaphore
ResumeThread
CreateSemaphoreA
SetStdHandle
IsBadCodePtr
IsBadReadPtr
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
IsBadWritePtr
LCMapStringW
LCMapStringA
SetEnvironmentVariableA
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
EnterCriticalSection
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetACP
HeapSize
TerminateProcess
GetLocalTime
GetSystemTime
GetTimeZoneInformation
RaiseException
RtlUnwind
GetStartupInfoA
GetOEMCP
GetCPInfo
GetProcessVersion
SetErrorMode
GlobalFlags
GetCurrentThread
GetFileTime
GetFileSize
TlsGetValue
LocalReAlloc
TlsSetValue
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcmpA
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpiA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
DuplicateHandle
lstrcpynA
SetLastError
FileTimeToLocalFileTime
FileTimeToSystemTime
LocalFree
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
GetProfileStringA
CloseHandle
WaitForSingleObject
GetTickCount
GetCommandLineA
MulDiv
GetProcAddress
GetModuleHandleA
GetModuleHandleW
LoadLibraryW
HeapCreate
InterlockedCompareExchange
InterlockedExchange
HeapDestroy
SuspendThread
SetThreadContext
GetThreadContext
Thread32Next
GetCurrentProcessId
Thread32First
CreateToolhelp32Snapshot
FlushInstructionCache
GetCurrentProcess
VirtualProtect
VirtualFree
VirtualAlloc
VirtualQuery
CreateMutexA
ReleaseMutex
TerminateThread
GetVolumeInformationA
SetCurrentDirectoryA
DeleteFileA
GetFileAttributesA
FindClose
FindFirstFileA
GlobalUnlock
GlobalLock
GlobalAlloc
Sleep
CreateEventA
CreateThread
WritePrivateProfileStringA
GetVersionExA
GetLastError
LoadLibraryA
FreeLibrary
GetFullPathNameA
WideCharToMultiByte
MultiByteToWideChar
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree
GlobalReAlloc
FindNextFileA
lstrcpyA
WinExec
lstrlenA
lstrcatA
InitializeCriticalSection
DeleteCriticalSection
GlobalFree
GlobalSize
ExitProcess
GetCurrentThreadId
GetModuleFileNameA
ReadFile
LockResource
LoadResource
FindResourceA
SetEvent
CreateFileA
WaitForMultipleObjects
WriteFile
FreeEnvironmentStringsW

user32

GetAncestor
GetGUIThreadInfo
DefWindowProcA
UpdateLayeredWindow
IsZoomed
CreateWindowExA
SetPropA
DestroyWindow
RemovePropA
GetPropA
ReleaseDC
GetDC
GetDlgItem
OpenIcon
GetWindowInfo
FlashWindow
EnumWindows
GetDlgCtrlID
InvalidateRect
IsIconic
SetForegroundWindow
PostQuitMessage
SetCursor
IsWindowEnabled
GetLastActivePopup
ValidateRect
GetActiveWindow
GetNextDlgTabItem
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
UnregisterClassA
PtInRect
GetMenuItemCount
TabbedTextOutA
DrawTextA
GrayStringA
SendDlgItemMessageA
IsDialogMessageA
GetWindowPlacement
GetMessagePos
GetMessageTime
GetClassLongA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
GetWindowTextA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
DestroyMenu
CreateDialogIndirectParamA
EndDialog
ExitWindowsEx
SetWindowPos
SetParent
UpdateWindow
GetWindowRect
SetLayeredWindowAttributes
GetWindowLongA
SetWindowTextA
GetWindowTextLengthA
GetClassNameA
GetParent
SwapMouseButton
SetClassLongA
LoadCursorFromFileA
CallNextHookEx
SetWindowsHookExA
GetKeyboardState
GetAsyncKeyState
ShowCursor
SetCapture
ReleaseCapture
ClipCursor
FindWindowExA
GetDoubleClickTime
mouse_event
SetCursorPos
ClientToScreen
SendInput
EnumChildWindows
GetWindow
GetDesktopWindow
SetTimer
ChangeDisplaySettingsA
EnumDisplaySettingsA
FindWindowA
MoveWindow
SetWindowLongA
MsgWaitForMultipleObjects
UnhookWindowsHookEx
PrintWindow
RegisterWindowMessageA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
PostThreadMessageA
KillTimer
CreateWindowStationA
CharUpperA
PostMessageA
GetWindowThreadProcessId
GetClientRect
GetForegroundWindow
AttachThreadInput
GetFocus
SetFocus
wvsprintfA
GetKeyState
EnableWindow
CallWindowProcA
keybd_event
MapVirtualKeyA
GetCaretPos
EnumThreadWindows
SendMessageTimeoutA
CharLowerA
IsWindowVisible
ShowWindow
GetCursorPos
WindowFromPoint
SendMessageA
FlashWindowEx
ShowWindowAsync
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
GetSystemMetrics
wsprintfA
MessageBoxA
LoadKeyboardLayoutA
GetKeyboardLayoutNameA
ActivateKeyboardLayout
GetKeyboardLayout
SetActiveWindow
IsWindow
SystemParametersInfoA
GetKeyboardLayoutList
WinHelpA
UnloadKeyboardLayout
RegisterClipboardFormatA
GetClassInfoA
DefWindowProcA
GetSystemMenu
DeleteMenu
GetMenu
SetMenu
PeekMessageA
IsIconic
SetFocus
GetActiveWindow
GetWindow
DestroyAcceleratorTable
SetWindowRgn
GetMessagePos
ScreenToClient
ChildWindowFromPointEx
CopyRect
LoadBitmapA
WinHelpA
KillTimer
SetTimer
ReleaseCapture
GetCapture
SetCapture
GetScrollRange
SetScrollRange
SetScrollPos
SetRect
InflateRect
IntersectRect
DestroyIcon
PtInRect
OffsetRect
IsWindowVisible
EnableWindow
RedrawWindow
GetWindowLongA
SetWindowLongA
GetSysColor
SetActiveWindow
SetCursorPos
LoadCursorA
SetCursor
GetDC
FillRect
IsRectEmpty
ReleaseDC
IsChild
DestroyMenu
SetForegroundWindow
GetWindowRect
EqualRect
UpdateWindow
ValidateRect
InvalidateRect
GetClientRect
GetFocus
GetParent
GetTopWindow
PostMessageA
IsWindow
SetParent
DestroyCursor
SendMessageA
SetWindowPos
MessageBoxA
GetCursorPos
GetSystemMetrics
IsZoomed
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
wsprintfA
PostQuitMessage
CopyAcceleratorTableA
GetKeyState
TranslateAcceleratorA
IsWindowEnabled
ShowWindow
SystemParametersInfoA
LoadImageA
EnumDisplaySettingsA
ClientToScreen
EnableMenuItem
GetSubMenu
GetDlgCtrlID
CreateAcceleratorTableA
CreateMenu
ModifyMenuA
AppendMenuA
CreatePopupMenu
DrawIconEx
CreateIconFromResource
CreateIconFromResourceEx
RegisterClipboardFormatA
GetWindowTextA
GetWindowTextLengthA
CharUpperA
UnregisterClassA
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
GetDlgItem
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
GetWindowPlacement
RegisterWindowMessageA
GetForegroundWindow
GetLastActivePopup
GetMessageTime
RemovePropA
CallWindowProcA
GetPropA
UnhookWindowsHookEx
SetPropA
GetClassLongA
SetWindowsHookExA
CreateWindowExA
GetMenuItemID
GetMenuItemCount
RegisterClassA
GetScrollPos
AdjustWindowRectEx
MapWindowPoints
SendDlgItemMessageA
ScrollWindowEx
IsDialogMessageA
SetWindowTextA
MoveWindow
CheckMenuItem
SetMenuItemBitmaps
GetMenuState
GetMenuCheckMarkDimensions
GetClassNameA
GetDesktopWindow
LoadStringA
GetSysColorBrush
SetRectEmpty
DispatchMessageA
GetMessageA
WindowFromPoint
DrawFocusRect
DrawEdge
DrawFrameControl
TranslateMessage
LoadIconA
MessageBoxW
GetPropW
SetClassLongW
GetClassLongW
PostMessageW
SetPropW
CallNextHookEx
CallWindowProcW
GetAsyncKeyState
DefWindowProcW
SetWindowLongW
RemovePropW
EmptyClipboard

gdi32

SetTextColor
SetBkMode
SelectObject
CreateFontIndirectA
CreateBitmap
SaveDC
RestoreDC
TextOutA
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
GetStockObject
GetDeviceCaps
PtVisible
RectVisible
ExtTextOutA
Escape
DeleteObject
CreateCompatibleDC
GetTextExtentPointA
DeleteDC
CreateCompatibleBitmap
CreateRectRgn
SetBkColor
GetObjectA
GetPixel
CreateDIBSection
CreateRectRgn
FillRgn
GetTextMetricsA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetViewportExtEx
ExtSelectClipRgn
LineTo
MoveToEx
ExcludeClipRect
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
CreateSolidBrush
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CombineRgn
PatBlt
CreatePen
GetObjectA
SelectObject
CreateBitmap
CreateDCA
CreateCompatibleBitmap
GetPolyFillMode
GetStretchBltMode
GetROP2
GetBkColor
GetBkMode
GetTextColor
CreateRoundRectRgn
CreateEllipticRgn
PathToRegion
EndPath
BeginPath
GetWindowOrgEx
GetViewportOrgEx
GetWindowExtEx
GetDIBits
RealizePalette
StretchBlt
CreatePalette
GetSystemPaletteEntries
CreateDIBitmap
DeleteObject
SelectClipRgn
CreatePolygonRgn
GetClipRgn
SetStretchBltMode
CreateRectRgnIndirect
SetBkColor
GetStockObject
CreateFontIndirectA
EndPage
EndDoc
DeleteDC
StartDocA
StartPage
BitBlt
GetTextExtentPoint32A
GetDeviceCaps
CreateCompatibleDC
Ellipse
Rectangle
LPtoDP
DPtoLP
GetCurrentObject
RoundRect
SetTextColor
SelectPalette

comdlg32

GetSaveFileNameW
ChooseColorA
GetSaveFileNameA
GetFileTitleA
GetOpenFileNameW
GetOpenFileNameA
GetFileTitleA

wininet

HttpSendRequestA
HttpOpenRequestA
FtpGetFileSize
InternetConnectA
InternetOpenA
FtpOpenFileA
InternetTimeToSystemTime
InternetTimeFromSystemTime
InternetReadFile
InternetSetCookieA
HttpQueryInfoA
InternetCloseHandle

shell32

ShellExecuteA
SHGetFileInfoA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetSpecialFolderPathA
SHFileOperationA
SHChangeNotify
Shell_NotifyIconA
ShellExecuteA

shlwapi

PathMakeSystemFolderA
PathIsSystemFolderA
PathIsDirectoryEmptyA
PathUnmakeSystemFolderA
PathFindFileNameA
StrTrimA
PathIsDirectoryA
PathRenameExtensionA
PathFindExtensionA
PathFileExistsA
PathRemoveBlanksA

oleaut32

SafeArrayUnaccessData
SafeArrayGetDim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantInit
SafeArrayCreate
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
VarR8FromBool
VarR8FromCy
SysFreeString
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayGetUBound
SysAllocString
VariantClear
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantChangeType
LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi

dbghelp

MakeSureDirectoryPathExists

ole32

OleInitialize
OleUninitialize
CLSIDFromString
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleRun
CoUninitialize
CoInitialize
OleInitialize
OleUninitialize
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoFreeUnusedLibraries

gdiplus

GdiplusStartup
GdipCreateFromHDC
GdipSetClipHrgn
GdipSetSmoothingMode
GdipCreatePen1
GdipDrawRectangle
GdipDeletePath
GdipDeletePen
GdipResetClip
GdipDeleteGraphics
GdipDrawPath

advapi32

RegCreateKeyExA
RegOpenKeyExA
RegFlushKey
RegDeleteValueA
RegDeleteKeyA
RegEnumValueA
RegSetValueExA
RegOpenKeyA
RegCloseKey
RegCreateKeyA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
GetUserNameA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegQueryValueExA
LookupAccountSidA
RegQueryValueA
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA

psapi

GetModuleFileNameExA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

winhttp

WinHttpTimeToSystemTime
WinHttpTimeFromSystemTime

oledlg

ord8

rasapi32

RasGetConnectStatusA
RasHangUpA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter
OpenPrinterA
DocumentPropertiesA
ClosePrinter

comctl32

ord17
ord17
ImageList_Destroy

wsock32

send
select
WSACleanup
recv
closesocket
WSAStartup

winmm

waveOutGetNumDevs
waveOutPause
waveOutReset
waveOutClose
waveOutOpen
midiOutUnprepareHeader
midiStreamOpen
midiStreamProperty
midiOutPrepareHeader
midiStreamOut
midiStreamStop
midiOutReset
midiStreamClose
midiStreamRestart
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutRestart
waveOutWrite

ws2_32

recvfrom
ioctlsocket
ntohl
WSAAsyncSelect
closesocket
recv
inet_ntoa
WSACleanup
getpeername
accept

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 192KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 560KB - Virtual size: 713KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7773cdbeb5bd1415e972f50daa8484e2

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

wininet

shell32

shlwapi

oleaut32

dbghelp

ole32

gdiplus

advapi32

psapi

version

winhttp

oledlg

rasapi32

winspool.drv

comctl32

wsock32

winmm

ws2_32

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 192KB - Virtual size: 190KB

.data Size: 560KB - Virtual size: 713KB

.rsrc Size: 24KB - Virtual size: 22KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 192KB - Virtual size: 190KB

.data
Size: 560KB - Virtual size: 713KB

.rsrc
Size: 24KB - Virtual size: 22KB