blackmoon | eb2fd9dd8d85947b27197462dbab70c3[.]bin | Triage

Sharing

General

Target

eb2fd9dd8d85947b27197462dbab70c3.bin
Size

109KB
MD5

7946af648462673ed244ecfbd97a420a
SHA1

b9927f1ea59705d7b4d2453635ad7516f56648e6
SHA256

0a9573b2ca2f59cc08ecc1d2739c88dc992d36b055bbe951d79885f95ede36c5
SHA512

c4edd46730e1f65f1734a6e891dab9ddcdf91f3da763d11b01feb03f41030a86fa315651faa09a7866a7821668640274ea31c6b3b59a93a82601c012421c5ddb
SSDEEP

3072:H2P4YiQ3dPxHeAsS3hu3uuPp9e5cn4+cVBqEmZwHDQ4:HuiQt55yu0p9e5xr24

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
static1/unpack001/a187c86b3ec6f53b07cc029407adec6d5cccd93702a356cfe78b952d3e8b9365.exe	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/a187c86b3ec6f53b07cc029407adec6d5cccd93702a356cfe78b952d3e8b9365.exe

Files

eb2fd9dd8d85947b27197462dbab70c3.bin
.zip

Password: infected
a187c86b3ec6f53b07cc029407adec6d5cccd93702a356cfe78b952d3e8b9365.exe
.exe windows:4 windows x86 arch:x86

Password: infected

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 328KB - Virtual size: 328KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE