blackmoon | b6bbdca5a994aa4fecb008117149e020_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

b6bbdca5a994aa4fecb008117149e020_NeikiAnalytics
Size

1.3MB
MD5

b6bbdca5a994aa4fecb008117149e020
SHA1

6421f769150fa7763e17fe92d2591e91b74459dd
SHA256

5c491bf30aa51fd07593287caa10d79497d8011fad1189d8b2a811d06fc49b26
SHA512

8641433458d8284f3135caeb0bb2e494a8608c74db5b17eda6eb41c3c89d30ea05e6efd0bd1c8aaa5a403a8d1bf849f351cd7baddc4433511b5c10a60e258dee
SSDEEP

24576:8vtxGqLA0gpT2idOKk326kLT3rCukV6gjvq5KZ0FJc7FY:4tH8LpT2oOV0PG9V6gjS/M7F

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b6bbdca5a994aa4fecb008117149e020_NeikiAnalytics

Files

b6bbdca5a994aa4fecb008117149e020_NeikiAnalytics
.exe windows:4 windows x86 arch:x86

af52b9663bfbdb3e1060ac9ec1e50adb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetComputerNameA
OpenProcess
CreateThread
Sleep
GlobalMemoryStatusEx
GetProcessHeap
HeapAlloc
GlobalSize
CreateFileA
DeviceIoControl
VirtualAlloc
VirtualFree
GetCurrentProcessId
GetEnvironmentVariableA
CreateProcessA
CloseHandle
VirtualAllocEx
CreateRemoteThread
GetExitCodeThread
VirtualFreeEx
CreateEventA
LocalFree
GetModuleHandleA
GetProcAddress
ExitProcess
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
GetPrivateProfileStringA
WritePrivateProfileStringA
ReadFile
GetFileSize
WriteFile
WaitForSingleObject
GetStartupInfoA
GetTickCount
GetCommandLineA
FreeLibrary
LoadLibraryA
LCMapStringA
OpenEventA
TerminateProcess
CreateFileMappingA
OpenFileMappingA
LocalAlloc
CreateMutexA

user32

GetWindowTextA
IsWindowVisible
GetWindowThreadProcessId
GetClassNameA
WaitForInputIdle
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA

advapi32

GetTokenInformation
OpenProcessToken

ws2_32

ioctlsocket
connect
select
closesocket
WSAStartup
send
setsockopt
getsockname
ntohs
WSAAsyncSelect
gethostbyname
WSACleanup
inet_addr
recv
socket
htons

psapi

EnumProcesses

shell32

ShellExecuteA

msvcrt

strstr
malloc
realloc
free
strchr
strrchr
rand
srand
_CIpow
_CIfmod
strtod
floor
??2@YAPAXI@Z
sprintf
atoi
_ftol
??3@YAXPAX@Z

shlwapi

PathFileExistsA

oleaut32

VariantTimeToSystemTime

Sections

.text
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xzgbiI0
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af52b9663bfbdb3e1060ac9ec1e50adb

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

psapi

shell32

msvcrt

shlwapi

oleaut32

Sections

.text Size: 152KB - Virtual size: 152KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 19KB - Virtual size: 80KB

xzgbiI0 Size: 1.2MB - Virtual size: 1.2MB

.rsrc Size: 1024B - Virtual size: 648B

.text
Size: 152KB - Virtual size: 152KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 19KB - Virtual size: 80KB

xzgbiI0
Size: 1.2MB - Virtual size: 1.2MB

.rsrc
Size: 1024B - Virtual size: 648B