blackmoon | 1c18bb857b30518447a790a1e496ebb6b422b37b7ac0f866cbb2a249e5787776

Sharing

Copy URL Twitter E-mail

General

Target

1c18bb857b30518447a790a1e496ebb6b422b37b7ac0f866cbb2a249e5787776
Size

417KB
MD5

c9c104d9154c7350e39f7eac9d62e00d
SHA1

3131e32d260730dba4b034fc74d4c00276f758ee
SHA256

1c18bb857b30518447a790a1e496ebb6b422b37b7ac0f866cbb2a249e5787776
SHA512

f5dfd2ab9a709fddc3449e509d4c0c2551c616c549b468e7389619b25dd75a59491234d3b0bf87801229a191f13614e05478dd0b5af0f26bf548d1493c42ed22
SSDEEP

12288:32DuHaxczXkm6B3YdwS1x+wK7wxecHil47ZpCXGvtbcTnTOFQNjH2DvIR:32DiaxcAm9CXGvNcTnTOFQNjH2DvIR

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c18bb857b30518447a790a1e496ebb6b422b37b7ac0f866cbb2a249e5787776

Files

1c18bb857b30518447a790a1e496ebb6b422b37b7ac0f866cbb2a249e5787776
.dll windows:4 windows x86 arch:x86

478bf7d44bdab2cfdcb55f677c1b2ebd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winmm

timeKillEvent
timeSetEvent

kernel32

DeleteTimerQueueTimer
RtlMoveMemory
RtlZeroMemory
CreateTimerQueueTimer
InterlockedCompareExchange
CreateThread
SetThreadPriority
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreatePipe
CreateProcessA
CloseHandle
PeekNamedPipe
ReadFile
GetExitCodeProcess
CreateFileA
GlobalAlloc
GlobalFree
GetLogicalProcessorInformation
Sleep
lstrcpyn
LocalSize
GetFileSizeEx
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
SetFilePointerEx
SetEndOfFile
MapViewOfFileEx
FlushViewOfFile
GetLastError
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateTimerQueue
CreateIoCompletionPort
DeleteTimerQueue
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
HeapCreate
HeapAlloc
HeapDestroy
GetProcessHeap
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
LeaveCriticalSection
DeleteCriticalSection
TryEnterCriticalSection
ExitProcess
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
CreateDirectoryA
DeleteFileA
CopyFileA
MoveFileA
GetModuleFileNameA
GetCommandLineA
FreeLibrary
LoadLibraryA
LCMapStringA

ws2_32

WSACleanup
freeaddrinfo
getaddrinfo
WSAStartup
recvfrom
bind
setsockopt
ioctlsocket
WSASocketA
sendto
closesocket
getsockname
inet_ntoa
ntohs
inet_addr
htons

user32

TranslateMessage
wsprintfA
GetMessageA
WaitForInputIdle
DispatchMessageA
PeekMessageA
MessageBoxA

msvcrt

floor
strncmp
memmove
??3@YAXPAX@Z
realloc
strchr
strrchr
_CIfmod
srand
__CxxFrameHandler
rand
malloc
atoi
_ftol
strtod
sprintf
modf
free

shlwapi

PathFileExistsA

Exports

Exports

UBroadcasts
UBuffAllocMem
UBuffCreate
UBuffDestory
UBuffFreeMem
UByteToTXT
UCRC32
UClose
UCloseAll
UCloseFile
UConnect
UConnectForwar
UCreate
UDestory
UForwarIf
UGetBind
UGetConnectINFO
UGetFileINFO
UGetForwarID
UGetIP
UGetIPv6
UGetMark1
UGetMark2
UGetOnlinelist
UGetPort
UGetRTT
UGetReceiveSpeed
UGetSendSpeed
UGetUUID
UGetUUIDLink
UGetVersion
UGetVersionLink
UHostNameToIP
UIsConnected
UKillTime
UNAT_PunchTy
UP2PConnect
UP2PConnectForwar
UP2PForwarServerLinkIf
UP2PGetEvents
UP2PGetID
UP2PServerLinkIf
UP2PSetForwarServer
UP2PSetLinkServerAUZ
UP2PSetServer
URecv
USend
USendFile
USend_UDP
USendto
USetCallback
USetFileRecv
USetMark1
USetMark2
USetPant
USetSpeed
USetSpeedLink
UShutDown
USocket
USocket_
UStartTime
UStartTime_
UTimeToTXT
Uinet_addr
Uinet_addr_Memcpy
Uinet_ntoa

Sections

.text
Size: 224KB - Virtual size: 222KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

478bf7d44bdab2cfdcb55f677c1b2ebd

Headers

File Characteristics

Imports

winmm

kernel32

ws2_32

user32

msvcrt

shlwapi

Exports

Exports

Sections

.text Size: 224KB - Virtual size: 222KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 24KB - Virtual size: 82KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 224KB - Virtual size: 222KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 24KB - Virtual size: 82KB

.reloc
Size: 8KB - Virtual size: 7KB