Resubmissions

03/03/2024, 11:19

240303-nexg9sab3410

03/03/2024, 11:12

240303-na59lsaa7310

General

  • Target
    connect.exe
  • Size 302KB
  • Sample240303-na59lsaa73
  • SHA256 3b195988c3097b2871304af86bd4db241310a7b4cf39281ac8b2bccad53f5a84
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Signatures

  • Blackmoon family
  • Detect Blackmoon payload 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • connect.exe
    .exe 302KB
  • out.upx
    .exe 813KB

connect.exe

  • SHA256 3b195988c3097b2871304af86bd4db241310a7b4cf39281ac8b2bccad53f5a84
  • MD5 SHA1 SHA512 SSDEEP
  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
4
Entry point
953152
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE
PDB paths