Behavioral task
behavioral1
Sample
6bc3d2c84fe9e6808ec252d03c462e8bf15a6d5b2e06355918c1a5f08b50fbab.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6bc3d2c84fe9e6808ec252d03c462e8bf15a6d5b2e06355918c1a5f08b50fbab.exe
Resource
win10v2004-20240226-en
General
-
Target
5b295c9a50b4f223056cd6b78ca4cadf.bin
-
Size
113KB
-
MD5
62eb3b03847d08ac55330de484f53f69
-
SHA1
e8826bcd31e15c5580b71d0c5ee7f8206fc8fb81
-
SHA256
e75da0d41404fc08b8936b6c5c8afd4d0ac1379cb50f4c5292e59215065cf7a9
-
SHA512
cac95c8d8bac13cef21565d8235aeb72ae29a081c05c2f01e48c686324e4142ba3361adb20b12af978d063209f9c219169549a32bcad4f9525cbffc821fb986e
-
SSDEEP
1536:rX4tJ1Qae4xvhrKR2fD5n5n+TCNqRbH0M4xL0EeJ8pam5GRbAdlBs6DJezSArsC7:01hWUfT+TCYJU5ZLjecdrs6DwSArsR74
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule static1/unpack001/6bc3d2c84fe9e6808ec252d03c462e8bf15a6d5b2e06355918c1a5f08b50fbab.exe family_blackmoon -
resource yara_rule static1/unpack001/6bc3d2c84fe9e6808ec252d03c462e8bf15a6d5b2e06355918c1a5f08b50fbab.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/6bc3d2c84fe9e6808ec252d03c462e8bf15a6d5b2e06355918c1a5f08b50fbab.exe
Files
-
5b295c9a50b4f223056cd6b78ca4cadf.bin.zip
Password: infected
-
6bc3d2c84fe9e6808ec252d03c462e8bf15a6d5b2e06355918c1a5f08b50fbab.exe.exe windows:6 windows x86 arch:x86
Password: infected
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 420KB - Virtual size: 4KB
Size: 428KB - Virtual size: 4B
���� Size: - Virtual size: