blackmoon | d1e0a82bf79f0572fa1c57524799539925c5cb518bc7bb66fbad5b356a13c91e

Sharing

Copy URL Twitter E-mail

General

Target

d1e0a82bf79f0572fa1c57524799539925c5cb518bc7bb66fbad5b356a13c91e
Size

6.8MB
MD5

22f9a73586a34cfdf0c160363bf7a817
SHA1

f1cbfa346df2f8738d65e4ac567bc02bb1571d97
SHA256

d1e0a82bf79f0572fa1c57524799539925c5cb518bc7bb66fbad5b356a13c91e
SHA512

05e6f75bc6efdf02c9bd5261d909620a3e92a1b38d77c66b360cc64148c836f89dd7671a0e3d654ea1058b736fea72d4692dad93e29e53a19ff9272c9fa5aa8a
SSDEEP

98304:sYoTThhGf1kcHy5pKe+2DD2+QQu7gWnDgLfKYoU2es6Y540MLElRUOTUOmX:6hMf+Bme++fZucADiEUX++0w3X

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1e0a82bf79f0572fa1c57524799539925c5cb518bc7bb66fbad5b356a13c91e

Files

d1e0a82bf79f0572fa1c57524799539925c5cb518bc7bb66fbad5b356a13c91e
.exe windows x86

6aebdb0435c0611cef3244e58fc2f96d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalLock
GetFileAttributesA
SetFilePointer
GetLastError
GetCurrentProcess
GetVersionExA
TerminateProcess
OpenProcess
GetWindowsDirectoryA
lstrcpyA
GetSystemDirectoryA
lstrlenA
GlobalAlloc
SetLastError
lstrcatA
GlobalUnlock
GetVersion
SetErrorMode
lstrcpynA
GetCurrentThreadId
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
InterlockedIncrement
InterlockedDecrement
LocalFree
FlushFileBuffers
LocalAlloc
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFlags
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
HeapSize
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
IsBadWritePtr
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
GetExitCodeProcess
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedExchange
GlobalFree
CreateToolhelp32Snapshot
Process32First
Process32Next
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
LCMapStringA
LoadLibraryA
FreeLibrary
SetFileAttributesA
GetStartupInfoA
CreateProcessA
WaitForSingleObject
FindFirstFileA
RemoveDirectoryA
DeleteFileA
FindNextFileA
FindClose
GetFileSize
ReadFile
GetTickCount
ReadConsoleA
GetStdHandle
WriteFile
GetModuleFileNameA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
GetCommandLineA
GetModuleHandleA
CreateFileA
MultiByteToWideChar
DeviceIoControl
GetTempPathA
IsDebuggerPresent
WideCharToMultiByte
GetProcAddress
CreateThread
CloseHandle
SetWaitableTimer
CreateWaitableTimerA
MoveFileA
CreateDirectoryA
Sleep
GetLocalTime
GetCurrentProcessId
VirtualFree
VirtualAlloc
GlobalMemoryStatusEx
SetConsoleTitleA

shlwapi

PathFileExistsA

ws2_32

send
WSACleanup
gethostbyname
inet_ntoa
recv
WSAStartup
closesocket
socket
htons
inet_addr
getsockname
ntohs
WSAAsyncSelect
connect
select

user32

LoadStringA
GetDlgCtrlID
SetWindowTextA
GetMenuItemCount
SetWindowPos
SetFocus
GetWindowPlacement
IsIconic
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
DrawTextA
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadCursorA
GetSysColorBrush
DestroyMenu
GetKeyState
CallNextHookEx
SetWindowsHookExA
GetLastActivePopup
PostMessageA
PostQuitMessage
SetForegroundWindow
GetForegroundWindow
IsWindowEnabled
EnableWindow
GetParent
GetWindow
PtInRect
GetWindowLongA
GetWindowTextA
SetWindowLongA
GetDlgItem
SystemParametersInfoA
GetClassNameA
SendMessageA
GetSystemMetrics
DestroyWindow
TabbedTextOutA
ClientToScreen
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
UnhookWindowsHookEx
LoadIconA
GrayStringA
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
FindWindowA
CreateWindowStationA
GetWindowThreadProcessId
ShowWindowAsync
MsgWaitForMultipleObjects
IsWindow
GetClientRect
MessageBoxA
wsprintfA
ReleaseDC
GetWindowRect
GetDesktopWindow
GetDC
DispatchMessageA
TranslateMessage
PeekMessageA
GetMessageA

gdi32

GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
CreateBitmap
DeleteObject
DeleteDC
GetDIBits
GetObjectA
StretchBlt
SetStretchBltMode
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetStockObject
GetDeviceCaps
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape

advapi32

ControlService
StartServiceA
CloseServiceHandle
OpenServiceA
CreateServiceA
OpenSCManagerA
DeleteService

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

shell32

SHGetSpecialFolderPathA

comctl32

ord17

Sections

.text
Size: 328KB - Virtual size: 324KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6.5MB - Virtual size: 6.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6aebdb0435c0611cef3244e58fc2f96d

Headers

File Characteristics

Imports

kernel32

shlwapi

ws2_32

user32

gdi32

advapi32

winspool.drv

shell32

comctl32

Sections

.text Size: 328KB - Virtual size: 324KB

.rdata Size: 28KB - Virtual size: 24KB

.data Size: 6.5MB - Virtual size: 6.6MB

.rsrc Size: 4KB - Virtual size: 664B

.text
Size: 328KB - Virtual size: 324KB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 6.5MB - Virtual size: 6.6MB

.rsrc
Size: 4KB - Virtual size: 664B