blackmoon | 240426-16lajaea81_pw_infected[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

240426-16lajaea81_pw_infected.zip
Size

8.0MB
MD5

c9ef8e198dd217084c5f5f64c28f09e8
SHA1

d1f776ffb2895a06955ff3850bd6fd5143709267
SHA256

609ae19f1e764199e1028a1a535a7a97cb958bc8182452625004e563760ddbc8
SHA512

719f972e7fcb520955b34a151450d5f6f804bf4b91057ecf9b6205ea58fc8365080b16a1fb075e955bdcf73366fbb1c36d066fc54eaac21c9e88bd20da2649fb
SSDEEP

196608:tqsHQBqINyjUX5S5edbXwHIjZDPmmgZgEb1NoG1BYNB:zqJSyZjJemgZguTQ

Score

10^/10

miner blackmoon xmrig

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
static1/unpack001/01c8fab34554578c4732f6e7fce4eee0_JaffaCakes118	family_blackmoon

XMRig Miner payload 1 IoCs

resource	yara_rule
static1/unpack001/01c8fab34554578c4732f6e7fce4eee0_JaffaCakes118	xmrig

Xmrig family
xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/01c8fab34554578c4732f6e7fce4eee0_JaffaCakes118

Files

240426-16lajaea81_pw_infected.zip
.zip

Password: infected
01c8fab34554578c4732f6e7fce4eee0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 108KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.8MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE