blackmoon | ade519b840844e75bd7eef2b34896d9a1f80685c775935cc96cf07c5afa28090

Sharing

Copy URL Twitter E-mail

General

Target

ade519b840844e75bd7eef2b34896d9a1f80685c775935cc96cf07c5afa28090
Size

480KB
MD5

11adf81317033b5214ae9a75d55c611e
SHA1

1dd95773058b4c154a3d6b427674c935e3eebdef
SHA256

ade519b840844e75bd7eef2b34896d9a1f80685c775935cc96cf07c5afa28090
SHA512

16226b6285887d59c88af336d6a704c989785f8dc5f4c99b5bbcd041ae6d02177546a5f73a1bdfa4a67fbb5915f4910575005d1a3f4bc4fb2ec026f1bb6bc53a
SSDEEP

12288:sFtyJrGXcewn4f2H/T9GpUcioAd2wjoZ69NtT:sFkhN4f2H/9ciBdPj0GtT

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ade519b840844e75bd7eef2b34896d9a1f80685c775935cc96cf07c5afa28090

Files

ade519b840844e75bd7eef2b34896d9a1f80685c775935cc96cf07c5afa28090
.exe windows:4 windows x86 arch:x86

9a3570b89b6b3e5109ad04f173bcadc9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathA
Sleep
lstrcpyA
lstrlenA
MultiByteToWideChar
GlobalAlloc
SetLastError
lstrcatA
GetTimeZoneInformation
GetVersion
GetCurrentThreadId
GetCurrentThread
lstrcmpA
GlobalDeleteAtom
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
LocalFree
FlushFileBuffers
lstrcpynA
GetFullPathNameA
LocalAlloc
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFlags
GetCurrentDirectoryA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
FileTimeToSystemTime
FileTimeToLocalFileTime
SetErrorMode
GetCPInfo
GetOEMCP
GetStartupInfoA
RtlUnwind
RaiseException
HeapSize
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
IsBadWritePtr
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedExchange
TerminateProcess
GetDriveTypeA
GetVersionExA
CreateMutexA
GetCurrentProcess
GetLastError
GetFileSize
SetFilePointer
WriteFile
FindFirstFileA
SetFileAttributesA
RemoveDirectoryA
FindNextFileA
FindClose
DeleteFileA
GlobalLock
GlobalUnlock
GlobalFree
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateThread
CloseHandle
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCommandLineA
WritePrivateProfileStringA
GetPrivateProfileStringA
MoveFileA
GetModuleFileNameA
GetTickCount
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
GetCurrentProcessId
Process32Next
Process32First
CreateFileA
GetDiskFreeSpaceExA
GlobalMemoryStatusEx
Module32Next
CreateToolhelp32Snapshot
GetFileAttributesA
VirtualProtect
VirtualFree
VirtualAlloc
SetWaitableTimer
CreateWaitableTimerA
UnmapViewOfFile
MapViewOfFile
CreateEventA
OpenEventA
CreateFileMappingA
OpenFileMappingA
lstrcmpiA

user32

SetForegroundWindow
GetForegroundWindow
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
RegisterWindowMessageA
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
DestroyMenu
IsIconic
GetWindowPlacement
SetFocus
GetMenuItemCount
GetDlgCtrlID
UnhookWindowsHookEx
GrayStringA
DrawTextA
TabbedTextOutA
ClientToScreen
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
SetWindowsHookExA
GetLastActivePopup
IsWindowEnabled
EnableWindow
SetCursor
PostMessageA
GetParent
GetWindow
PtInRect
GetCursorPos
SystemParametersInfoA
GetDC
ReleaseDC
GetSystemMetrics
PeekMessageA
CreateDialogIndirectParamA
UpdateWindow
GetMessageA
SendMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
PostQuitMessage
SetWindowTextA
GetDlgItem
ShowWindow
SetWindowLongA
GetWindowRect
ScreenToClient
SetWindowPos
GetWindowLongA
GetWindowTextLengthA
wsprintfA
MessageBoxA
CreateWindowStationA
GetWindowThreadProcessId
GetClassNameA
GetWindowTextA
IsWindowVisible
UnregisterClassA

ws2_32

gethostname
inet_ntoa
recvfrom
sendto
listen
bind
accept
__WSAFDIsSet
WSAStartup
getpeername
WSACleanup
select
WSAAsyncSelect
ntohs
getsockname
recv
send
gethostbyname
connect
inet_addr
htons
socket
closesocket
htonl

gdi32

GetDeviceCaps
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
SelectObject
DeleteDC
DeleteObject
GetObjectA
GetStockObject
CreateBitmap
SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox

shell32

SHGetSpecialFolderPathA
SHEmptyRecycleBinA
ShellExecuteA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA

comctl32

ord17

wininet

FindNextUrlCacheEntryA
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA

Sections

.text
Size: 316KB - Virtual size: 314KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.5AQn0
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a3570b89b6b3e5109ad04f173bcadc9

Headers

File Characteristics

Imports

kernel32

user32

ws2_32

gdi32

shell32

winspool.drv

advapi32

comctl32

wininet

Sections

.text Size: 316KB - Virtual size: 314KB

.rdata Size: 24KB - Virtual size: 21KB

.data Size: 64KB - Virtual size: 187KB

.5AQn0 Size: 72KB - Virtual size: 71KB

.text
Size: 316KB - Virtual size: 314KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 64KB - Virtual size: 187KB

.5AQn0
Size: 72KB - Virtual size: 71KB