blackmoon | 8ce6994ac1c5c8063c740b84cf8aef392a0664db3ab6a57df2ae5c3d49fb0254

Sharing

Copy URL Twitter E-mail

General

Target

8ce6994ac1c5c8063c740b84cf8aef392a0664db3ab6a57df2ae5c3d49fb0254
Size

5.4MB
MD5

4b554bb7db62440527669297af3e0e77
SHA1

f264d421f0cfee7aaf1e940e7610db18c1b89098
SHA256

8ce6994ac1c5c8063c740b84cf8aef392a0664db3ab6a57df2ae5c3d49fb0254
SHA512

a7119fe9416377dbbbd811bbf3c9df4f7fed0e278de781b09c6ed9ac793024ee623498f38c92e3a9d3075973cab8cc0bef426ce3ee054d35e93bbac203aef85c
SSDEEP

98304:VowPxzjnSUGPSbc6UomYXFh2n4mnSwyLYy8jkpUDdhh9Sv:z7SUG6c2mnGLon98

Score

10^/10

vmprotect blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8ce6994ac1c5c8063c740b84cf8aef392a0664db3ab6a57df2ae5c3d49fb0254

Files

8ce6994ac1c5c8063c740b84cf8aef392a0664db3ab6a57df2ae5c3d49fb0254
.exe windows:5 windows x86

76992af32cc542c5ef2010eeae41bdaf

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentDirectoryA
LocalFree
GetCommandLineW
CreateDirectoryA
GetPrivateProfileStringA
CloseHandle
ReadFile
GetFileSize
CreateFileA
WriteFile
WritePrivateProfileStringA
FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
MoveFileA
Sleep
GetTickCount
GetCommandLineA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetStartupInfoA
HeapFree
RtlUnwind
InterlockedDecrement
InterlockedIncrement
UnhandledExceptionFilter
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
GetEnvironmentVariableA
IsBadReadPtr
HeapDestroy
HeapCreate
IsBadWritePtr
RaiseException
SetFilePointer
LCMapStringW
HeapSize
GetCPInfo
GetACP
GetOEMCP
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
IsBadCodePtr
SetStdHandle
FlushFileBuffers
FlushInstructionCache
GetCurrentProcess
GetPrivateProfileSectionA
VirtualAlloc
GetModuleHandleW
GetComputerNameA
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerA
TerminateProcess
OpenProcess
CreateToolhelp32Snapshot
CreateEventA
OpenEventA
RtlMoveMemory
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
VirtualFree
WideCharToMultiByte
MultiByteToWideChar
FreeEnvironmentStringsA
GetVersion
GetVersionExA
GetCurrentProcess
FreeLibrary
TerminateProcess
GetSystemInfo
CreateToolhelp32Snapshot
Thread32First
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
GetTickCount
GetLocalTime
GlobalFree
GetProcAddress
LocalAlloc
LoadLibraryA
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
FlushFileBuffers
GetCurrentProcessId
GetLastError
GetModuleFileNameW
CreateEventA
GetModuleHandleA
GetSystemTimeAsFileTime
VirtualQuery
LocalFree
CreateFileA
ReadFile
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

shlwapi

PathFileExistsA

user32

OpenClipboard
SetClipboardData
PeekMessageA
GetMessageA
DispatchMessageA
EmptyClipboard
GetClipboardData
SystemParametersInfoA
LoadCursorW
MsgWaitForMultipleObjects
CreateWindowExW
SendMessageW
ShowWindow
UpdateWindow
LoadIconW
RegisterClassExW
DefWindowProcW
GetClassLongA
IsWindow
GetMessageW
TranslateMessage
DispatchMessageW
GetWindowRect
SetPropW
MoveWindow
MessageBeep
SetForegroundWindow
GetPropW
SetWindowPos
wsprintfA
MessageBoxA
GetParent
IsIconic
DestroyIcon
SetCaretPos
GetKeyState
DestroyCaret
CreateCaret
GetCursorPos
GetIconInfo
SetWindowRgn
RedrawWindow
IsRectEmpty
GetWindowTextW
GetDC
SetFocus
GetFocus
SetCapture
IsZoomed
DestroyWindow
SendMessageA
TrackMouseEvent
SetWindowLongW
GetWindowLongW
ReleaseDC
EndPaint
BeginPaint
SetCursor
CallWindowProcW
ReleaseCapture
SetTimer
UpdateLayeredWindow
KillTimer
RemovePropW
PostMessageA
CloseClipboard
CharUpperBuffW
MessageBoxW

gdi32

DeleteObject
SelectObject
DeleteDC
CreateCompatibleDC
BitBlt
CreateRoundRectRgn
GetObjectW
GetDIBits
GetTextExtentPoint32W
CreateDIBSection

advapi32

CryptReleaseContext
CryptCreateHash
CryptDestroyHash
CryptHashData
CryptAcquireContextA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
CloseServiceHandle
QueryServiceConfigW
OpenServiceW
EnumServicesStatusExW
OpenSCManagerW

shell32

CommandLineToArgvW

comctl32

ImageList_GetIconSize
ImageList_GetIcon

ole32

CreateStreamOnHGlobal
CLSIDFromString

gdiplus

GdipDrawPolygon
GdipFillPolygon
GdipDeleteMatrix
GdipGetRegionScans
GdipGetRegionScansCount
GdipCreateMatrix
GdipCombineRegionRect
GdipGetStringFormatFlags
GdipSetStringFormatHotkeyPrefix
GdipGetStringFormatHotkeyPrefix
GdipGetStringFormatTrimming
GdipCreateStringFormat
GdipCreatePathGradientFromPath
GdipGetImagePixelFormat
GdipGetRegionBounds
GdipMeasureCharacterRanges
GdipCreateRegion
GdipSetStringFormatMeasurableCharacterRanges
GdipSetClipPath
GdipImageSelectActiveFrame
GdipCreateBitmapFromHICON
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipCreateRegionHrgn
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromHBITMAP
GdipDeleteRegion
GdipCreateFromHDC
GdipBitmapGetPixel
GdipCreateLineBrushFromRect
GdipSetStringFormatAlign
GdipGetStringFormatAlign
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipGetFontStyle
GdipGetFontSize
GdipSetInterpolationMode
GdipSetCompositingQuality
GdipDrawString
GdipDeletePath
GdipDrawPath
GdipSetPenDashStyle
GdipDeletePen
GdipDrawRectangle
GdipFillPath
GdipCreateSolidFill
GdipDeleteBrush
GdipFillRectangle
GdipClosePathFigure
GdipAddPathArc
GdipCreatePath
GdipGraphicsClear
GdipCloneBitmapArea
GdipGetFontHeight
GdipDeleteStringFormat
GdipResetClip
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipCreateImageAttributes
GdipGetVisibleClipBounds
GdipSetClipRect
GdipSetClipRegion
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDrawImageRectRect
GdipMeasureString
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipLoadImageFromStream
GdipGetFamilyName
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdiplusStartup
GdipDrawImageRect

imm32

ImmGetCompositionStringA
ImmReleaseContext
ImmGetContext
ImmAssociateContext

ws2_32

bind
htons
socket
accept
__WSAFDIsSet
select
recv
closesocket
send
inet_ntoa
getpeername
ntohs
connect
inet_addr
htonl
recvfrom
listen
WSACleanup
sendto
gethostname
gethostbyname
getsockname
WSAStartup

wtsapi32

WTSSendMessageW

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

76992af32cc542c5ef2010eeae41bdaf

Headers

File Characteristics

Imports

kernel32

shlwapi

user32

gdi32

advapi32

shell32

comctl32

ole32

gdiplus

imm32

ws2_32

wtsapi32

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 164KB - Virtual size: 164KB

.vmp0 Size: 1.8MB - Virtual size: 1.8MB

.vmp1 Size: 2.1MB - Virtual size: 2.1MB

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 4KB

.l1 Size: 20KB - Virtual size: 20KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 164KB - Virtual size: 164KB

.vmp0
Size: 1.8MB - Virtual size: 1.8MB

.vmp1
Size: 2.1MB - Virtual size: 2.1MB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 4KB

.l1
Size: 20KB - Virtual size: 20KB