blackmoon | 45641897ad337edbee3340b53804c13c0d9928444624e2bfb6dba99aa58dc6ca

Sharing

Copy URL

Twitter E-mail

General

Target

45641897ad337edbee3340b53804c13c0d9928444624e2bfb6dba99aa58dc6ca
Size

2.6MB
MD5

95bb26676ba4402abf45195b5fcca0ad
SHA1

633cccc3e294f2a9a1e0206bac8420efddadf201
SHA256

45641897ad337edbee3340b53804c13c0d9928444624e2bfb6dba99aa58dc6ca
SHA512

f86022403175ad54c84e97163593372357c382e0f4abb060620b906385ad8f65100a06dfd2b7a66fbaecc44ef066bb387aadbb764a57e0e451e171077f10b515
SSDEEP

24576:TCnfD+2rAad+bsYYdAIjngp3m2r55w0bo1bdO+2NC2buzM7k3wJmOKMCmLt8:TudIsrZM+2Ngz53wJWqe

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
45641897ad337edbee3340b53804c13c0d9928444624e2bfb6dba99aa58dc6ca

Files

45641897ad337edbee3340b53804c13c0d9928444624e2bfb6dba99aa58dc6ca
.dll windows:4 windows x86

d1a30d8209d7db3518c09a7feeb999b9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemDirectoryA
WideCharToMultiByte
MultiByteToWideChar
GetProcessHandleCount
DuplicateHandle
WriteProcessMemory
ReadProcessMemory
lstrcpyn
GetCurrentThreadId
ResumeThread
CreateRemoteThread
OpenThread
GetLogicalDriveStringsA
QueryDosDeviceA
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
MulDiv
GetDiskFreeSpaceA
GetCurrentDirectoryA
ReadFile
GetFileSize
CreateFileA
DeleteFileA
GetTempFileNameA
GetCommandLineA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
VirtualFree
GetVersion
RtlUnwind
InterlockedDecrement
InterlockedIncrement
TerminateProcess
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
VirtualAllocEx
CopyFileA
GetTempPathA
GetVersionExA
GetCurrentProcess
CloseHandle
Sleep
GetLastError
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
LCMapStringW
SetFilePointer
IsBadWritePtr
RaiseException
WriteFile
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
CreateThread
GetACP
GetCPInfo
LCMapStringW
SetFilePointer
IsBadWritePtr
VirtualAlloc
RaiseException
VirtualFree
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetFileType
GetStdHandle
SetHandleCount
WaitForSingleObject
lstrcpynW
lstrcpynA
GetCommandLineA
WriteProcessMemory
VirtualAllocEx
lstrcpyn
WideCharToMultiByte
OpenThread
OpenProcess
GetTickCount
CloseHandle
GetLastError
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
TerminateProcess
InterlockedIncrement
GetOEMCP
RtlUnwind
GetVersion
HeapCreate
VirtualFreeEx
GetModuleHandleA
VirtualQuery
LoadLibraryExA
FreeLibrary
IsWow64Process
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateRemoteThread
GetExitCodeThread
GetWindowsDirectoryA
RtlMoveMemory
Module32First
Module32Next
GetNativeSystemInfo
TerminateThread
DuplicateHandle
CopyFileA
GetTempFileNameA
GetTempPathA
GetSystemDirectoryA
MultiByteToWideChar
CreateWaitableTimerA
SetWaitableTimer
LeaveCriticalSection
GetCurrentProcess
GetVersionExA
CreateProcessA
PeekNamedPipe
lstrlenW
lstrcpyA
ReadProcessMemory
VirtualQueryEx
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
IsBadCodePtr
SetStdHandle
FlushFileBuffers
LoadLibraryA
InterlockedDecrement
InitializeCriticalSection
GetCurrentThreadId
SetProcessAffinityMask
EnterCriticalSection
DeleteCriticalSection
VirtualProtect
RtlZeroMemory
HeapAlloc
HeapFree
lstrcmpW
lstrcmpiW
GetProcessHeap
ExitProcess
HeapReAlloc
IsBadReadPtr
LCMapStringA
WriteFile
CreateFileA
ReadFile
GetFileSize
DeleteFileA
GetProcAddress
GetUserDefaultLCID
GetDiskFreeSpaceExA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetStartupInfoA
FindNextFileA
FindFirstFileA
FindClose
GetModuleFileNameA

shlwapi

PathFindFileNameA
StrToIntW
StrToIntExW
PathFindExtensionA
PathFindFileNameA
PathFileExistsA

user32

PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
MsgWaitForMultipleObjects
CallWindowProcA
SetWindowLongA
GetWindowLongA
GetAncestor
GetWindowThreadProcessId
IsWindowVisible
GetParent
EnumWindows
RegisterWindowMessageA
PostThreadMessageA
ClientToScreen
IsWindowVisible
GetWindowThreadProcessId
GetWindowTextA
GetClassNameA
MsgWaitForMultipleObjects
RegisterWindowMessageA
EnumWindows
GetParent
GetAncestor
CallWindowProcA
PeekMessageA
TranslateMessage
DispatchMessageA
wsprintfA
GetMessageA
MessageBoxA
GetForegroundWindow
FindWindowA
GetDlgItem
WindowFromPoint
GetCursorPos
SendMessageA
ShowWindow

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
CryptHashData
CryptGetHashParam
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExA
RegOpenKeyA

ws2_32

WSACleanup
WSAStartup
htons

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

shell32

SHGetSpecialFolderPathA

ole32

CoInitialize
CLSIDFromProgID
CoCreateInstance
OleRun
CoUninitialize
CLSIDFromString

oleaut32

SafeArrayDestroy
VariantChangeType
VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SafeArrayCreate
SysAllocString
VariantClear

Exports

Exports

True

Sections

.text
Size: 976KB - Virtual size: 975KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.5MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d1a30d8209d7db3518c09a7feeb999b9

Headers

File Characteristics

Imports

kernel32

shlwapi

user32

advapi32

ws2_32

version

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 976KB - Virtual size: 975KB

.rdata Size: 32KB - Virtual size: 30KB

.data Size: 1.5MB - Virtual size: 1.6MB

.rsrc Size: 4KB - Virtual size: 624B

.reloc Size: 44KB - Virtual size: 40KB

.text
Size: 976KB - Virtual size: 975KB

.rdata
Size: 32KB - Virtual size: 30KB

.data
Size: 1.5MB - Virtual size: 1.6MB

.rsrc
Size: 4KB - Virtual size: 624B

.reloc
Size: 44KB - Virtual size: 40KB