Behavioral task
behavioral1
Sample
699b222667bbc6d120abc8b3a01c5e38f34cf4695ad4ddfb67fa65ba88cfa8ee.exe
Resource
win7-20240221-en
General
-
Target
88caeb9dd161c52a550e6d2dd10382989729d73582c203fc80e75874edb924e1
-
Size
100KB
-
MD5
890b71c0568e261e0cd4f046f8940617
-
SHA1
4c89e9bf182d093e584bd77f92e1af656731aabd
-
SHA256
88caeb9dd161c52a550e6d2dd10382989729d73582c203fc80e75874edb924e1
-
SHA512
73d0331a93633b15fde81e944bbba511fe4edcc6fd8d1979d344b45d96cc461f5620d66ee346e9e4c6ed2201171fcc97b8f65304e94d7e2af08b14e4b3b6c801
-
SSDEEP
1536:rcxT6vaI4cEcKQlkubP9ghlcqz/W04sUgjsUhpqQChrVm6CaXU:uT0rEcKQuaP9Wlcq60zUgjzCQiq
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule static1/unpack001/699b222667bbc6d120abc8b3a01c5e38f34cf4695ad4ddfb67fa65ba88cfa8ee.exe family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/699b222667bbc6d120abc8b3a01c5e38f34cf4695ad4ddfb67fa65ba88cfa8ee.exe
Files
-
88caeb9dd161c52a550e6d2dd10382989729d73582c203fc80e75874edb924e1.zip
Password: infected
-
699b222667bbc6d120abc8b3a01c5e38f34cf4695ad4ddfb67fa65ba88cfa8ee.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 300KB - Virtual size: 299KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE