blackmoon | 908abf880e97219c1a45e6383f0b0b0a2f44a17e76f5e2b7573841350836f8e7

General

Target

908abf880e97219c1a45e6383f0b0b0a2f44a17e76f5e2b7573841350836f8e7
Size

8.0MB
MD5

cb83e5ca7032fd7f3396ff9b5cd8cb7e
SHA1

24a0f38534d4e9e5953139d02e14746800feea0d
SHA256

908abf880e97219c1a45e6383f0b0b0a2f44a17e76f5e2b7573841350836f8e7
SHA512

fef7b394d147ca05f0805e08d3d2d5d4d2c157ca3f61d43c2a43f76deab894316392536f5799a09a321afe86764119e0f3d71c528e034e4ce1658f86a8874125
SSDEEP

196608:olnUArhqK+1znA8ktRyPsIfX626OGO3QeGf/5Z5a0IJri:O/FqJfX2OGOge8/5DV8i

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
908abf880e97219c1a45e6383f0b0b0a2f44a17e76f5e2b7573841350836f8e7

Files

908abf880e97219c1a45e6383f0b0b0a2f44a17e76f5e2b7573841350836f8e7
.exe windows:4 windows x86

bf68a089cdb571fc161a7cddc4daa77b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32Next
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
WaitForSingleObject
GetExitCodeThread
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
Process32First
GetCommandLineA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
CreateToolhelp32Snapshot
GetConsoleCursorInfo
SetConsoleCursorInfo
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
Sleep
GetCurrentProcessId
OpenProcess
CloseHandle
GetVersionExA
SetConsoleCursorPosition
GetStdHandle
GetCurrentProcess

user32

GetMessageA
GetWindowThreadProcessId
MessageBoxA
wsprintfA
DispatchMessageA
PeekMessageA
FindWindowA
TranslateMessage

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

wininet

HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA

msvcrt

_strdup
srand
rand
sprintf
_atoi64
_ftol
strrchr
strchr
atoi
modf
malloc
??3@YAXPAX@Z
free
strncmp
__CxxFrameHandler
memmove
system
printf
strstr

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8.0MB - Virtual size: 8.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bf68a089cdb571fc161a7cddc4daa77b

Headers

File Characteristics

Imports

kernel32

user32

advapi32

wininet

msvcrt

Sections

.text Size: 21KB - Virtual size: 20KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 8.0MB - Virtual size: 8.1MB

.rsrc Size: 1024B - Virtual size: 664B

.text
Size: 21KB - Virtual size: 20KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 8.0MB - Virtual size: 8.1MB

.rsrc
Size: 1024B - Virtual size: 664B