General

  • Target

    rotects.zip

  • Size

    25.2MB

  • MD5

    57fb70d018de80944ef53d67711a7874

  • SHA1

    5ba8d2208c0ecb1937909c04120817af813f5df4

  • SHA256

    939a063d194fafef4d5a3da3837a0908a5e53cb78a502caaaee67eff71df07fd

  • SHA512

    9db206ac20e6637d0e184357cec4e9ce9128aff33157a2b468204bbdeab4ac30a8cefae2cdd32037eccf75769cd544a73e679d798cfdff2afbc3a0cf955a9b4e

  • SSDEEP

    786432:wexTXJ/zT5EXgvicN7l4XFhawncTduJh4G/mFnz03dgKwXE:weNB/5FjN7luFEacTduJqG/ltgK7

Score
10/10

Malware Config

Signatures

  • Blackmoon family
  • Detect Blackmoon payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • rotects.zip
    .zip

    Password: infected

  • rotects/AProtects.exe
    .exe windows:5 windows x86 arch:x86

    4430b7f7759f34c724e0a09c64bdb759


    Code Sign

    Headers

    Imports

    Sections

  • rotects/DataState.dll
    .dll windows:4 windows x86 arch:x86

    ca49b2e8b6dffb16ae093c8874a8d74a


    Headers

    Imports

    Exports

    Sections

  • rotects/madbasic_.bpl
    .dll windows:5 windows x86 arch:x86

    ae5a6a29d3cea5a63ad958cfb1a5fb0c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • rotects/maddisAsm_.bpl
    .dll windows:5 windows x86 arch:x86

    22531f752b354d949452fbdf15d6da72


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • rotects/madexcept_.bpl
    .dll windows:5 windows x86 arch:x86

    2a873ab64f922b5d3d6841d9d0c267c9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • rotects/rtl120.bpl
    .dll windows:5 windows x86 arch:x86

    fac06cfe16c2052ff34e27439885ff00


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • rotects/vcl120.bpl
    .dll windows:5 windows x86 arch:x86

    e8b35382b98f61463da4a5d7a3b50753


    Code Sign

    Headers

    Imports

    Exports

    Sections