blackmoon | cf59b5f38afe987e95514ffd9b35d1de5c21efb0772774d97ae89c7a7d17c052

Sharing

Copy URL

Twitter E-mail

General

Target

cf59b5f38afe987e95514ffd9b35d1de5c21efb0772774d97ae89c7a7d17c052
Size

928KB
MD5

21f1348e9baca86a6f5dea53ac27156f
SHA1

9342039e7c706bf372a1f510ff0da16e6faeed90
SHA256

cf59b5f38afe987e95514ffd9b35d1de5c21efb0772774d97ae89c7a7d17c052
SHA512

0ee6ed82fe87847dbe9c9c4a651612836a4fcb35d8ea9b3f3484f9fb6dc3dbb9241ac3a750037aed65417eef8b9503c5327ece7b9f40ea5c51927a97644d338d
SSDEEP

24576:4pawO164HUj9kwyQeGs/bDp7avtTcfR/36cwgZ8inu92BhbSSIQwWj94HUhNhkn3:4dO164HUj9kwyQet/bYqfR/36cgK5nY

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf59b5f38afe987e95514ffd9b35d1de5c21efb0772774d97ae89c7a7d17c052

Files

cf59b5f38afe987e95514ffd9b35d1de5c21efb0772774d97ae89c7a7d17c052
.dll windows:4 windows x86 arch:x86

f74dc421920cf97e6425945fd76f5ae3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

IsBadReadPtr
GetStartupInfoA
SetFileAttributesA
GetTickCount
GetFileSize
SetFilePointer
FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
MoveFileA
CreateDirectoryA
CopyFileA
GetUserDefaultLCID
MulDiv
GetDiskFreeSpaceA
GetCurrentDirectoryA
GetPrivateProfileStringA
GetLocalTime
WritePrivateProfileStringA
GetModuleFileNameA
GetEnvironmentVariableA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCommandLineA
LCMapStringA
VirtualQueryEx
HeapReAlloc
ExitProcess
GetModuleFileNameW
GetCommandLineW
GetModuleHandleW
lstrcmpW
lstrcmpiA
HeapDestroy
HeapCreate
GetAtomNameW
GlobalUnlock
GetVersionExA
GetVersion
TerminateThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetSystemPowerState
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
CloseHandle
lstrcpynA
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
WTSGetActiveConsoleSessionId
RtlZeroMemory
GetLastError
TerminateProcess
CreateWaitableTimerA
SetWaitableTimer
CreateFileA
GetModuleHandleA
GetProcAddress
lstrcpyn
CreateThread
GlobalMemoryStatusEx
MultiByteToWideChar
WideCharToMultiByte
CreateIoCompletionPort
GetSystemInfo
GetQueuedCompletionStatus
RtlMoveMemory
VirtualFree
CreatePipe
CreateProcessA
PeekNamedPipe
ReadFile
GetCurrentProcess
GetExitCodeProcess
GetDriveTypeA
WriteFile
IsWow64Process
Module32First
LocalAlloc
LocalFree
GetDateFormatA
GetTimeFormatA
GlobalLock
GlobalAlloc
FreeLibrary
SetEvent
_lclose
GetProcessHeap
ProcessIdToSessionId
WaitForSingleObject
WriteProcessMemory
ReadProcessMemory
lstrcatW
lstrcmpiW
lstrcmpA
lstrlenW
lstrlenA
HeapFree
InterlockedDecrement
InterlockedIncrement
LocalSize
HeapAlloc
CreateEventA
Module32Next
SetProcessWorkingSetSize
GlobalFree
GlobalSize
VirtualAlloc
LoadLibraryA
GetCurrentThreadId
Sleep

user32

IsIconic
SetRect
SetWindowRgn
LoadIconW
EnumPropsExW
RemovePropA
RemovePropW
GetPropA
GetPropW
SetPropA
SetPropW
IsZoomed
GetMenu
SetMenu
DrawMenuBar
RegisterWindowMessageW
SystemParametersInfoW
GetMessageW
MsgWaitForMultipleObjects
GetSystemMetrics
CallNextHookEx
GetWindowTextA
OpenInputDesktop
SetWindowsHookExA
PostMessageA
keybd_event
LockWorkStation
UnhookWindowsHookEx
BlockInput
mouse_event
ClientToScreen
TranslateAcceleratorW
DispatchMessageW
IsChild
TranslateMDISysAccel
IsDialogMessageW
PostQuitMessage
FillRect
DrawFocusRect
OffsetRect
CopyRect
FrameRect
CreateIconFromResourceEx
GetSysColorBrush
GetWindowDC
CallWindowProcA
DefWindowProcA
EnumChildWindows
SendMessageA
RedrawWindow
GetWindowTextLengthA
KillTimer
SetTimer
MessageBoxW
SetWindowTextW
SetParent
UpdateWindow
ValidateRect
InvalidateRect
ScreenToClient
GetFocus
CopyIcon
PostMessageW
DefWindowProcW
CreateMDIWindowW
DialogBoxParamW
CreateDialogParamW
EndDialog
DialogBoxIndirectParamW
DestroyWindow
SetClassLongW
GetClassLongW
CreateDialogIndirectParamW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
CloseDesktop
SetThreadDesktop
GetThreadDesktop
DrawIcon
LoadImageW
DrawIconEx
UpdateLayeredWindow
EnumThreadWindows
DrawTextA
ExitWindowsEx
SetCursorPos
ShowWindow
FindWindowA
GetWindowRect
GetDC
CopyImage
ReleaseDC
CloseWindow
SetForegroundWindow
MoveWindow
EnumWindows
CreateMenu
CreatePopupMenu
GetSystemMenu
LoadMenuW
GetMenuInfo
GetCursorInfo
DestroyMenu
GetMenuItemCount
GetMenuItemInfoW
AppendMenuW
InsertMenuW
SetMenuInfo
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
PeekMessageA
wsprintfA
MessageBoxA
CharLowerW
CharUpperW
LoadStringW
SetMenuDefaultItem
SetMenuItemInfoW
CheckMenuItem
RemoveMenu
MenuItemFromPoint
GetMenuDefaultItem
GetMenuState
GetMenuItemRect
GetMenuStringW
TrackPopupMenu
CheckMenuRadioItem
GetMenuItemID
InflateRect
IsWindowVisible
GetClassNameA
GetWindowThreadProcessId
SetWindowLongA
GetWindowLongA
SetLayeredWindowAttributes
GetMessageA
TranslateMessage
DispatchMessageA
OpenWindowStationA
SetProcessWindowStation
BeginPaint
EndPaint
TrackMouseEvent
GetDlgItem
GetAncestor
SetWindowLongW
GetAsyncKeyState
IsWindow
FindWindowExW
GetClassNameW
GetWindowTextLengthW
GetWindowTextW
GetParent
GetWindowLongW
SendMessageW
DestroyCursor
SetCursor
GetClientRect
SetCapture
ReleaseCapture
LoadCursorW
DestroyIcon
DestroyAcceleratorTable
GetSysColor
IsWindowEnabled
EnableWindow
SetWindowPos
GetNextDlgTabItem
SetFocus
CallWindowProcW
GetIconInfo
GetDesktopWindow
GetSubMenu

advapi32

RegisterServiceCtrlHandlerA
SetServiceStatus
OpenProcessToken
LookupPrivilegeValueA
DuplicateTokenEx
SetTokenInformation
AdjustTokenPrivileges
CreateProcessAsUserA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegCreateKeyA
LookupAccountSidA
RegOpenKeyA
RegEnumKeyA
RegEnumValueA
StartServiceCtrlDispatcherA
OpenServiceA
QueryServiceStatus
QueryServiceConfigA
QueryServiceConfig2A
ChangeServiceConfig2A
GetServiceDisplayNameA
GetServiceKeyNameA
DeleteService
StartServiceA
ControlService
ChangeServiceConfigA
EnumServicesStatusA
EnumServicesStatusExA
EnumDependentServicesA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA

shell32

DragAcceptFiles
DragFinish
SHGetSpecialFolderPathA
DragQueryFileW
CommandLineToArgvW
Shell_NotifyIconW
ShellExecuteA

ole32

CLSIDFromProgID
CoCreateInstance
OleRun
StringFromGUID2
CLSIDFromString
GetHGlobalFromStream
CreateStreamOnHGlobal
CoUninitialize
CoInitialize

winmm

waveInClose
waveInStop
waveInUnprepareHeader
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveInOpen
waveInGetNumDevs
waveInGetDevCapsA

ws2_32

getsockname
recvfrom
htonl
ntohs
getpeername
send
recv
select
__WSAFDIsSet
accept
socket
bind
listen
WSAStartup
closesocket
WSARecv
WSASend
WSASocketA
inet_addr
htons
connect
WSACleanup
gethostname
gethostbyname
inet_ntoa
sendto

gdi32

GetDIBits
SetTextColor
SetBkMode
SetBkColor
GetTextMetricsA
GetDeviceCaps
CreateDIBSection
GdiFlush
CreateRoundRectRgn
GetObjectA
CreateSolidBrush
GetObjectW
GetStretchBltMode
SetStretchBltMode
StretchBlt
CreateFontIndirectW
CreatePatternBrush
DeleteDC
BitBlt
GetStockObject
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
GetTextExtentPoint32A
GetTextColor
SetPixel
CreatePen
LineTo
MoveToEx
SelectClipRgn
CreateEllipticRgnIndirect
Arc
Ellipse
GetPixel
SelectObject

comctl32

_TrackMouseEvent
InitCommonControlsEx

msimg32

AlphaBlend
GradientFill

psapi

EnumProcessModules
GetModuleFileNameExA

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock

wininet

HttpQueryInfoA
InternetReadFile
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetGetConnectedState
InternetCloseHandle

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

oleaut32

VariantCopy
VariantTimeToSystemTime
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
VariantChangeType

shlwapi

PathFileExistsA
StrToIntExW
wvnsprintfW
PathFindFileNameW
PathRemoveFileSpecW
StrToIntW
StrTrimW
PathIsDirectoryA
StrFormatByteSize64A

winhttp

WinHttpAddRequestHeaders
WinHttpSetOption
WinHttpCloseHandle
WinHttpSetCredentials
WinHttpSetTimeouts
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpConnect
WinHttpOpen
WinHttpOpenRequest
WinHttpCrackUrl
WinHttpCheckPlatform
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpQueryHeaders

gdiplus

GdipIsVisibleClipEmpty
GdipIsVisiblePoint
GdipIsVisibleRect
GdipSaveGraphics
GdipRestoreGraphics
GdipBeginContainer
GdipBeginContainer2
GdipEndContainer
GdipLoadImageFromFile
GdipLoadImageFromStream
GdipCloneImage
GdipGetImageRawFormat
GdipGetImagePixelFormat
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipGetImageDimension
GdipGetImageBounds
GdipGetImageWidth
GdipGetImageHeight
GdipGetImageHorizontalResolution
GdipGetImageVerticalResolution
GdipGetImageThumbnail
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipCreateHICONFromBitmap
GdipCreateFromHWND
GdipGetImageGraphicsContext
GdipCreateFont
GdipCreateFontFromLogfontW
GdipDeletePrivateFontCollection
GdipDeleteFontFamily
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipCloneFont
GdipGetLogFontW
GdipGetLogFontA
GdipGetFamily
GdipGetFontStyle
GdipGetFontSize
GdipGetFontUnit
GdipGetFontHeight
GdipGetFontHeightGivenDPI
GdipCreatePath
GdipCreatePath2
GdipClonePath
GdipResetPath
GdipGetPathFillMode
GdipSetPathFillMode
GdipGetPointCount
GdipGetPathData
GdipStartPathFigure
GdipClosePathFigure
GdipClosePathFigures
GdipSetPathMarker
GdipClearPathMarkers
GdipReversePath
GdipGetPathLastPoint
GdipAddPathLine
GdipAddPathArc
GdipAddPathBezier
GdipAddPathCurve
GdipAddPathCurve2
GdipAddPathClosedCurve
GdipAddPathClosedCurve2
GdipAddPathRectangle
GdipAddPathEllipse
GdipAddPathPie
GdipAddPathPolygon
GdipAddPathPath
GdipAddPathString
GdipTransformPath
GdipIsClipEmpty
GdipFlattenPath
GdipWidenPath
GdipWindingModeOutline
GdipWarpPath
GdipIsVisiblePathPoint
GdipIsOutlineVisiblePathPoint
GdipCreateRegionRect
GdipCreateRegionPath
GdipCreateRegionHrgn
GdipCreateRegionRgnData
GdipCloneRegion
GdipSetInfinite
GdipSetEmpty
GdipDrawClosedCurve
GdipCombineRegionRegion
GdipCombineRegionPath
GdipTranslateRegion
GdipTransformRegion
GdipGetRegionBounds
GdipGetRegionDataSize
GdipGetRegionData
GdipGetRegionHRgn
GdipIsEmptyRegion
GdipIsInfiniteRegion
GdipIsEqualRegion
GdipIsVisibleRegionPoint
GdipIsVisibleRegionRect
GdipGetRegionScansCount
GdipGetClipBounds
GdipCreateBitmapFromFile
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromHICON
GdipTranslateClip
GdipCloneBitmapArea
GdipBitmapSetResolution
GdipCreateSolidFill
GdipCreateMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipCreateMatrix2
GdipCreateMatrix3
GdipCloneMatrix
GdipSetMatrixElements
GdipGetMatrixElements
GdipMultiplyMatrix
GdipInvertMatrix
GdipScaleMatrix
GdipShearMatrix
GdipTransformMatrixPoints
GdipVectorTransformMatrixPoints
GdipIsMatrixInvertible
GdipIsMatrixIdentity
GdipIsMatrixEqual
GdipNewInstalledFontCollection
GdipNewPrivateFontCollection
GdipPrivateAddFontFile
GdipPrivateAddMemoryFont
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilyMonospace
GdipGetFamilyName
GdipIsStyleAvailable
GdipGetEmHeight
GdipGetCellAscent
GdipGetCellDescent
GdipGetLineSpacing
GdipGetPathWorldBounds
GdipGetVisibleClipBounds
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesColorKeys
GdipSetImageAttributesGamma
GdipSetImageAttributesNoOp
GdipSetImageAttributesThreshold
GdipResetImageAttributes
GdipSetImageAttributesToIdentity
GdipCloneImageAttributes
GdipCreateImageAttributes
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipDeleteRegion
GdipDeletePath
GdipDeleteFont
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipDeleteBrush
GdipFillRectangle
GdipCreateTexture
GdiplusShutdown
GdipDisposeImage
GdipSaveImageToStream
GdipCreateBitmapFromHBITMAP
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream
GdiplusStartup
GdipDrawCurve2
GdipDrawCurve
GdipDrawPath
GdipDrawPolygon
GdipDrawPie
GdipDrawEllipse
GdipDrawRectangle
GdipDrawBezier
GdipDrawArc
GdipDrawLine
GdipGetNearestColor
GdipTransformPointsI
GdipTransformPoints
GdipGetDpiY
GdipGetDpiX
GdipGetPageScale
GdipSetPageScale
GdipGetPageUnit
GdipSetPageUnit
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipDeleteMatrix
GdipGetWorldTransform
GdipSetWorldTransform
GdipGetPixelOffsetMode
GdipSetPixelOffsetMode
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipGetInterpolationMode
GdipGetRegionScans
GdipGetClip
GdipResetClip
GdipSetClipHrgn
GdipSetClipRegion
GdipSetClipRect
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRect
GdipDrawImagePointRect
GdipDrawImagePoints
GdipDrawImageRect
GdipDrawImageRectRect
GdipDrawImage
GdipDrawDriverString
GdipSetInterpolationMode
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipReleaseDC
GdipGetDC
GdipFlush
GdipCreateFromHDC
GdipSetImageAttributesColorMatrix
GdipGetImageAttributesAdjustedPalette
GdipMeasureCharacterRanges
GdipCreateRegion
GdipMeasureString
GdipDrawString
GdipFillRegion
GdipFillClosedCurve2
GdipFillClosedCurve
GdipSetImageAttributesOutputChannelColorProfile
GdipFillPie
GdipFillEllipse
GdipFillPolygon
GdipGraphicsClear
GdipCreateBitmapFromResource
GdipDrawClosedCurve2
GdipSetImageAttributesWrapMode
GdipCombineRegionRect
GdipSetImageAttributesRemapTable
GdipFillPath

dbghelp

MakeSureDirectoryPathExists

crypt32

CryptStringToBinaryW

atl

ord42

msvcrt

sprintf
free
malloc
atoi
_ftol
strncpy
??3@YAXPAX@Z
strrchr
??2@YAPAXI@Z
_CIfmod
_CIpow
_atoi64
strchr
modf
strtod
atof
strncmp
srand
_stricmp
realloc
memmove
__CxxFrameHandler
_except_handler3
calloc
__dllonexit
_onexit
rand
floor

Exports

Exports

CallKeyHookProc
ServiceMain
init

Sections

.text
Size: 772KB - Virtual size: 769KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 88KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f74dc421920cf97e6425945fd76f5ae3

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

winmm

ws2_32

gdi32

comctl32

msimg32

psapi

wtsapi32

userenv

wininet

version

oleaut32

shlwapi

winhttp

gdiplus

dbghelp

crypt32

atl

msvcrt

Exports

Exports

Sections

.text Size: 772KB - Virtual size: 769KB

.rdata Size: 28KB - Virtual size: 24KB

.data Size: 88KB - Virtual size: 172KB

.CRT Size: 4KB - Virtual size: 4B

.rsrc Size: 4KB - Virtual size: 756B

.reloc Size: 28KB - Virtual size: 26KB

.text
Size: 772KB - Virtual size: 769KB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 88KB - Virtual size: 172KB

.CRT
Size: 4KB - Virtual size: 4B

.rsrc
Size: 4KB - Virtual size: 756B

.reloc
Size: 28KB - Virtual size: 26KB