blackmoon | 5d58add3593b6db6198fd59ea802c27c562db13cd5f55ea4698642d3492396df

Sharing

Copy URL Twitter E-mail

General

Target

5d58add3593b6db6198fd59ea802c27c562db13cd5f55ea4698642d3492396df
Size

4.8MB
MD5

3a74b365413b44498e7e6c639ba8f4af
SHA1

90e2958beb36740379db33e30cab3a5b13460824
SHA256

5d58add3593b6db6198fd59ea802c27c562db13cd5f55ea4698642d3492396df
SHA512

75d1927ee0f9411dff1d990ec41830ff6f55d6352b9f1ba037f51408db4b21cb2aaae42d16ef25ecdc68540af1f922bb5015dd0889512e433452de3bb80b6174
SSDEEP

49152:aUB4rxycZ3QR5Yg+sjfJLPrQsi6TyqC6++h2NSbDeqxR96DU:ZBWxx3Y5/bLP3/yqLbDJR9OU

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d58add3593b6db6198fd59ea802c27c562db13cd5f55ea4698642d3492396df

Files

5d58add3593b6db6198fd59ea802c27c562db13cd5f55ea4698642d3492396df
.dll windows:4 windows x86

f77cb79621c556dcea84f33e2a0ab667

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSAStartup
inet_ntoa
WSACleanup
accept
listen
bind
htons
getsockname
ioctlsocket
socket
closesocket
connect
inet_addr
__WSAFDIsSet
select
recv
send
ntohs
shutdown
htonl
gethostname
WSAGetLastError
gethostbyname

kernel32

GetTempPathA
GetVersionExA
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
LoadLibraryA
FreeLibrary
GetCommandLineA
GetPrivateProfileStringA
LCMapStringA
FindFirstFileA
SetFilePointer
SetEndOfFile
SetFileAttributesA
GetLocalTime
GetTickCount
GetEnvironmentVariableA
FormatMessageA
GetUserDefaultLCID
GetFileSize
ReadFile
WritePrivateProfileStringA
HeapReAlloc
ExitProcess
IsBadStringPtrA
LocalSize
GlobalSize
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
TerminateThread
QueryDosDeviceW
CreateProcessA
lstrcpyA
VirtualQueryEx
SetPriorityClass
OpenProcess
GetCurrentProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
IsBadReadPtr
CreateFileMappingA
FindClose
FindFirstFileW
WriteFile
CreateFileW
CreateThread
DeleteFileA
LocalFree
CreateDirectoryW
LocalAlloc
lstrlenW
Sleep
GetExitCodeThread
ReadProcessMemory
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
RtlMoveMemory
GetComputerNameA
GetVolumeInformationA
DeviceIoControl
lstrcpyn
CreateFileA
CreateEventA
OpenEventA
GetNativeSystemInfo
GetModuleHandleW
SetWaitableTimer
CreateWaitableTimerW
HeapFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
MultiByteToWideChar
VirtualFree
VirtualAlloc
GetProcAddress
CloseHandle
TerminateProcess
GetWindowsDirectoryA
WideCharToMultiByte
HeapAlloc
GetProcessHeap
GetModuleFileNameA
VirtualQuery
GetModuleHandleA
lstrlenA
GetCurrentThreadId
InterlockedExchange
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetStdHandle
DeleteCriticalSection
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
LCMapStringW
UnhandledExceptionFilter
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetACP
HeapSize
RaiseException
GetSystemTime
ExitThread
RtlUnwind
GetOEMCP
GetCPInfo
GetProcessVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalFlags
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
lstrcpynA
FlushFileBuffers
InterlockedDecrement
InterlockedIncrement
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
MulDiv
GetVersion
GetTimeZoneInformation
GetSystemDirectoryA
SetLastError
lstrcatA
GetLastError

user32

MessageBoxTimeoutA
SetClipboardData
CloseClipboard
CreateIconFromResourceEx
CopyImage
MsgWaitForMultipleObjects
RegisterClassExW
DefWindowProcW
CreateWindowExW
SendMessageW
SystemParametersInfoA
GetClassNameW
SetForegroundWindow
SetWindowPos
EmptyClipboard
OpenClipboard
PeekMessageA
GetMessageA
CallWindowProcA
ShowWindow
IsWindowVisible
FindWindowExA
GetForegroundWindow
GetDesktopWindow
GetWindow
GetClassNameA
GetWindowTextLengthA
GetWindowTextA
IsWindow
DispatchMessageA
wsprintfA
SetClassLongA
GetClassLongA
SetRect
MessageBoxA
SetWindowTextA
EnableWindow
IsWindowEnabled
GetWindowRect
MoveWindow
SetActiveWindow
MessageBeep
GetPropA
GetMessageW
TranslateMessage
DispatchMessageW
RemovePropA
PostMessageW
SetTimer
GetAsyncKeyState
DestroyWindow
GetWindowThreadProcessId
CreatePopupMenu
AppendMenuA
TrackPopupMenuEx
DestroyMenu
LoadCursorW
LookupIconIdFromDirectoryEx
SetCursor
SendMessageA
KillTimer
IntersectRect
InvalidateRect
UpdateLayeredWindow
ReleaseCapture
LoadCursorFromFileW
IsZoomed
IsIconic
PtInRect
SetParent
PostMessageA
UpdateWindow
ValidateRect
GetSystemMetrics
SetWindowRgn
GetParent
ReleaseDC
SetCaretPos
GetCursorPos
CallWindowProcW
TrackMouseEvent
GetClientRect
GetDlgItem
GetWindowLongA
CreateWindowExA
DestroyCursor
SetWindowLongA
LoadCursorA
ScreenToClient
GetSysColor
LoadBitmapA
RegisterHotKey
UnregisterHotKey
GetActiveWindow
PostQuitMessage
GetLastActivePopup
SetWindowsHookExA
CallNextHookEx
GetKeyState
GetNextDlgTabItem
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
ClientToScreen
TabbedTextOutA
DrawTextA
GrayStringA
UnhookWindowsHookEx
CreateDialogIndirectParamA
EndDialog
UnregisterClassA
GetDlgCtrlID
GetMenuItemCount
SendDlgItemMessageA
IsDialogMessageA
GetWindowPlacement
RegisterWindowMessageA
GetMessagePos
GetMessageTime
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetWindowTextW
AdjustWindowRectEx
MapWindowPoints
LoadIconA
GetSysColorBrush
LoadStringA
PostThreadMessageA
GetClassLongW
SetPropA
SetWindowLongW
SetFocus
GetDC
DefMDIChildProcA
GetFocus
BeginPaint
EndPaint
SetCapture
DefWindowProcA

shlwapi

PathFindExtensionA
PathFileExistsA
PathIsDirectoryW
StrToIntExA
PathFindFileNameA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

gdi32

SetMapMode
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
GetDeviceCaps
DeleteObject
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
CreateRoundRectRgn
CreateRectRgn
GetDIBits
SetTextColor
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateBitmap
TranslateCharsetInfo
BitBlt
CreateCompatibleDC
CreateDIBSection
SelectObject
GetStockObject
GetObjectA
ExtCreateRegion
CombineRgn
CreateSolidBrush
CreateFontA
DeleteDC
SetViewportOrgEx

comdlg32

GetOpenFileNameA
ChooseColorA

advapi32

RegSetValueExA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey

shell32

DragAcceptFiles
DragFinish
DragQueryFileA
Shell_NotifyIconW
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA
SHGetSpecialFolderPathA

ole32

OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CLSIDFromString
StringFromGUID2
CLSIDFromProgID
CoCreateInstance
CoRevokeClassObject
OleRun

wininet

InternetConnectA
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
HttpQueryInfoA
InternetSetOptionA
InternetOpenA

atl

ord42

gdiplus

GdipImageSelectActiveFrame
GdipCreateHBITMAPFromBitmap
GdipGetCompositingQuality
GdipGetFamilyName
GdipGetFontSize
GdipGetFontStyle
GdipCreateFont
GdipCreateFontFamilyFromName
GdipCreatePathGradientFromPath
GdipDrawPolygon
GdipFillPolygon
GdipCreatePen2
GdipDeleteFontFamily
GdipDeleteFont
GdipMeasureString
GdipGetImagePixelFormat
GdipCloneBitmapArea
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRectRect
GdipDisposeImage
GdiplusStartup
GdipCreateImageAttributes
GdipSetClipRegion
GdipSetClipRect
GdipDrawRectangle
GdipDeletePen
GdipSetPenDashStyle
GdipResetClip
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipCreateStringFormat
GdipSetStringFormatHotkeyPrefix
GdipDeleteStringFormat
GdipGraphicsClear
GdipCreateLineBrushFromRect
GdipFillRectangle
GdipDeleteBrush
GdipGetFontHeight
GdipCreateSolidFill
GdipDrawString
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipSetCompositingQuality
GdipSetInterpolationMode
GdipSetStringFormatAlign
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipGetStringFormatAlign
GdipGetStringFormatTrimming
GdipCreateLineBrush
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImageRect
GdipGetStringFormatFlags
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipLoadImageFromStream
GdipSaveImageToStream
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipSetStringFormatMeasurableCharacterRanges
GdipCreateRegion
GdipMeasureCharacterRanges
GdipGetRegionBounds
GdipFillPath
GdipClosePathFigure
GdipAddPathArc
GdipCreatePath
GdipDeletePath
GdipDrawPath
GdipCreateRegionHrgn
GdipDeleteRegion

oleaut32

SafeArrayAllocData
SafeArrayAllocDescriptor
VariantInit
VariantChangeType
SysFreeString
SafeArrayCreate
RegisterTypeLi
LHashValOfNameSys
SafeArrayDestroy
VarR8FromBool
VarR8FromCy
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
OleLoadPicture
VariantCopy
SysAllocString
VariantClear
SafeArrayGetDim
SafeArrayGetLBound
LoadTypeLi
SafeArrayGetUBound

psapi

GetModuleFileNameExA
GetProcessImageFileNameW

imm32

ImmGetContext
ImmAssociateContext

iphlpapi

GetAdaptersInfo

oledlg

ord8

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

comctl32

ImageList_Add
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_EndDrag
ord17
ImageList_BeginDrag

Exports

Exports

Happy

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.4MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f77cb79621c556dcea84f33e2a0ab667

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

shlwapi

version

gdi32

comdlg32

advapi32

shell32

ole32

wininet

atl

gdiplus

oleaut32

psapi

imm32

iphlpapi

oledlg

winspool.drv

comctl32

Exports

Exports

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.rdata Size: 36KB - Virtual size: 32KB

.data Size: 2.4MB - Virtual size: 2.5MB

.rsrc Size: 4KB - Virtual size: 828B

.reloc Size: 108KB - Virtual size: 107KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 36KB - Virtual size: 32KB

.data
Size: 2.4MB - Virtual size: 2.5MB

.rsrc
Size: 4KB - Virtual size: 828B

.reloc
Size: 108KB - Virtual size: 107KB