Overview

overview

10

Static

static

10

YY5331过�...ok.dll

windows7-x64

1

YY5331过�...ok.dll

windows10-2004-x64

1

YY5331过�...er.exe

windows7-x64

1

YY5331过�...er.exe

windows10-2004-x64

1

YY5331过�...al.exe

windows7-x64

1

YY5331过�...al.exe

windows10-2004-x64

1

YY5331过�...ne.exe

windows7-x64

7

YY5331过�...ne.exe

windows10-2004-x64

7

YY5331过�...31.dll

windows7-x64

7

YY5331过�...31.dll

windows10-2004-x64

7

YY5331过�...32.dll

windows7-x64

1

YY5331过�...32.dll

windows10-2004-x64

1

YY5331过�...32.sys

windows7-x64

1

YY5331过�...32.sys

windows10-2004-x64

1

YY5331过�...ll.dll

windows7-x64

1

YY5331过�...ll.dll

windows10-2004-x64

1

YY5331过�...ss.exe

windows7-x64

1

YY5331过�...ss.exe

windows10-2004-x64

1

YY5331过�...��.exe

windows7-x64

1

YY5331过�...��.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13c6557d63aa06db7cedebfbc5f0ff6c

  • Size

    1.3MB

  • MD5

    13c6557d63aa06db7cedebfbc5f0ff6c

  • SHA1

    92f976c1f4c57a808df09fb23380ce34360c0a5b

  • SHA256

    8272912ee1bf16a05192042253c37356e5944c0e26795772a14c606565ca58b6

  • SHA512

    73501bdb060f9cb7a0f5850f447ab3518d25656bf46a44c44dd90a10afb9a5086e3b577ce62b1988f1cd429dcf89b8ca2d6ca2f282c08fc8e973d2ede91b91ec

  • SSDEEP

    24576:l0bHrWjb1l8bpkudlSwsd/Ygky5+jexfsaO+lcpQZpMfWfQoyE8uj3gBH4m8b:2LWvvepHbQ+jZyF6WfQJu8Bz8b

Score
10/10
blackmoon

Malware Config

Signatures

  • Blackmoon family
    blackmoon
  • Detect Blackmoon payload 1 IoCs
  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

Files

  • 13c6557d63aa06db7cedebfbc5f0ff6c
    .rar
  • YY5331过非法VE/ADDRESSESFIRST.TMP
  • YY5331过非法VE/Addys.tmp
  • YY5331过非法VE/DAHook.dll
    .dll windows:4 windows x86 arch:x86

    847129de4cb396f6d65a2c3fd914154a


    Headers

    Imports

    Exports

    Sections

  • YY5331过非法VE/DAKernDat.dat
  • YY5331过非法VE/MEMORYFIRST.TMP
  • YY5331过非法VE/SysCallRetriever.exe
    .exe windows:4 windows x86 arch:x86

    22e26b67d8d33e6ccbb1da428b01b687


    Headers

    Imports

    Sections

  • YY5331过非法VE/SysCallSignal.exe
    .exe windows:4 windows x86 arch:x86

    4467f6f3ae05e670dfdde4a5da870444


    Headers

    Imports

    Sections

  • YY5331过非法VE/Vzla Engine.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • YY5331过非法VE/dak31.dll
    .dll windows:4 windows x86 arch:x86

    ff5e62499396d4492cd184261bd060b6


    Headers

    Imports

    Exports

    Sections

  • YY5331过非法VE/dak32.dll
    .dll windows:4 windows x86 arch:x86

    a7537a763be3c3c6a63dec8ed1c19d25


    Headers

    Imports

    Exports

    Sections

  • YY5331过非法VE/dak32.sys
    .sys windows:6 windows x86 arch:x86

    cd6e1fde8eb2c1c1d7fafe4511663265


    Headers

    Imports

    Sections

  • YY5331过非法VE/emptydll.dll
    .dll windows:4 windows x86 arch:x86

    6760a0ff6425a5b23bc76f162583bd01


    Headers

    Imports

    Sections

  • YY5331过非法VE/emptyprocess.exe
    .exe windows:4 windows x86 arch:x86

    78c94c599fd4e7e62fd1296d28f17711


    Headers

    Imports

    Sections

  • YY5331过非法VE/腾讯游戏过非法.exe
    .exe windows:4 windows x86 arch:x86

    26f9730a19ca0efd06d8dd0a13662b74


    Headers

    Imports

    Sections