blackmoon | dc010de4391e4e2c878b1eebd73e4d1ab3aa684938910e0b59b0173ef016cf4d

Sharing

Copy URL Twitter E-mail

General

Target
dc010de4391e4e2c878b1eebd73e4d1ab3aa684938910e0b59b0173ef016cf4d
Size 4.2MB
Sample240514-snpagacc21
SHA256 dc010de4391e4e2c878b1eebd73e4d1ab3aa684938910e0b59b0173ef016cf4d
MD5 df6980e47c554e38faba047d8713dbb8
SHA1 3182f0a2bc99765dac3e52d2dd9dab6120ed16f0
SHA512 3d239b5d572cac327787af1759ca76bc8f96da3c01021731246b60da98da4681017d9bd366ca1e4b803bd800e12ee190784db4d44c0d8076ca04ed0e4af6175d
SSDEEP 98304:MamlZr+XhCUf/7WIzUJ6HL//Wwxgy0Q0i5Xnhb/:5XhDf/7W9i3jbz5nh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

oss_ak blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

detect oss ak 1 IoCs

oss ak information detected.

oss_ak

resource	yara_rule
sample	detect_ak_stuff

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dc010de4391e4e2c878b1eebd73e4d1ab3aa684938910e0b59b0173ef016cf4d

File Explorer

dc010de4391e4e2c878b1eebd73e4d1ab3aa684938910e0b59b0173ef016cf4d

.exe 4.2MB

dc010de4391e4e2c878b1eebd73e4d1ab3aa684938910e0b59b0173ef016cf4d

IMPHASH 58efb53b43cc5f673b204107d96104e1
SHA256 dc010de4391e4e2c878b1eebd73e4d1ab3aa684938910e0b59b0173ef016cf4d
MD5 df6980e47c554e38faba047d8713dbb8
SHA1 3182f0a2bc99765dac3e52d2dd9dab6120ed16f0
SHA512 3d239b5d572cac327787af1759ca76bc8f96da3c01021731246b60da98da4681017d9bd366ca1e4b803bd800e12ee190784db4d44c0d8076ca04ed0e4af6175d
SSDEEP 98304:MamlZr+XhCUf/7WIzUJ6HL//Wwxgy0Q0i5Xnhb/:5XhDf/7W9i3jbz5nh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect Blackmoon payload
detect oss ak

oss ak information detected.

oss_ak
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

690227

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenFileMappingA GetVersion RtlUnwind GetCurrentProcess TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue SetHandleCount GetStdHandle GetFileType DeleteCriticalSection FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate IsBadWritePtr RaiseException GetCPInfo GetACP GetOEMCP GetStringTypeA GetStringTypeW SetUnhandledExceptionFilter IsBadCodePtr LCMapStringW TerminateProcess FlushFileBuffers GetCurrentThread lstrcmpiA lstrcmpA GlobalDeleteAtom lstrlenA LocalFree lstrcpyA GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA lstrcatA lstrcpynA LocalAlloc GlobalHandle GlobalReAlloc LocalReAlloc GlobalFlags GetProcessVersion SetErrorMode SetEndOfFile GetTimeZoneInformation ExitThread HeapSize UnhandledExceptionFilter CompareStringA CompareStringW SetEnvironmentVariableA GetExitCodeThread CreateFileMappingA DeviceIoControl InitializeCriticalSection lstrcpyn LeaveCriticalSection EnterCriticalSection GetSystemTime InterlockedCompareExchange OpenFileMappingW MapViewOfFile OpenEventA SetEvent UnmapViewOfFile VirtualProtect VirtualFree VirtualAlloc MoveFileA GetVolumeInformationA GetDriveTypeA GetCurrentDirectoryA CreateDirectoryA GetLogicalDriveStringsA SetFileAttributesA FindFirstFileA FindNextFileA FindClose GetTickCount TerminateThread GlobalFree MultiByteToWideChar GlobalAlloc GlobalLock GlobalUnlock GetLastError GetPrivateProfileStringA WritePrivateProfileStringA WriteFile ReadFile SetFilePointer GetLocalTime CreateFileA GetSystemTimeAsFileTime GetFileSize InterlockedExchange InterlockedDecrement InterlockedIncrement GetComputerNameA QueryPerformanceFrequency QueryPerformanceCounter CreateWaitableTimerA SetWaitableTimer GetCurrentProcessId GetCurrentThreadId GetWindowsDirectoryA GetFileAttributesA GetTempPathA WideCharToMultiByte CreateMutexA CreateThread ReleaseMutex OutputDebugStringA FindResourceA SizeofResource LoadResource LockResource EnumResourceNamesA MulDiv LCMapStringA LoadLibraryA FreeLibrary GetModuleFileNameA GetCommandLineA DeleteFileA GetStartupInfoA CreateProcessA WaitForSingleObject CloseHandle Sleep GetProcAddress IsBadReadPtr HeapFree HeapReAlloc HeapAlloc ExitProcess GetModuleHandleA GetProcessHeap SetStdHandle OpenProcess

user32

GetSysColorBrush LoadStringA GetDCEx LockWindowUpdate GetWindowPlacement IsDialogMessageA GetMenuCheckMarkDimensions LoadBitmapA ModifyMenuA GetFocus GetNextDlgTabItem GetKeyState CallNextHookEx ValidateRect SetWindowsHookExA GetLastActivePopup GetDesktopWindow WindowFromPoint SetMenuItemBitmaps wsprintfW SetCapture EndPaint BeginPaint DrawTextA FillRect DrawIconEx GetIconInfo CreateIconFromResourceEx CreateIconFromResource SystemParametersInfoA FrameRect CallWindowProcA InflateRect GetWindowTextLengthA GetWindowTextA SetRectEmpty CopyRect DrawFrameControl DrawTextW DefWindowProcA ReleaseCapture OffsetRect GetClassLongA SetClassLongA SetRect PostThreadMessageA DestroyIcon AppendMenuW EnableMenuItem CheckMenuItem GetMenuState GetMenu CreatePopupMenu DestroyMenu GetMenuItemCount GetDlgCtrlID UpdateWindow IsWindowEnabled SetFocus SetWindowTextA GetDlgItem CallWindowProcW IsMenu TrackPopupMenu DrawEdge InvalidateRect SetCursor GetSysColor SendMessageW GetClassNameA UnionRect IsRectEmpty GrayStringA TabbedTextOutA GetWindowDC RegisterHotKey KillTimer SetTimer GetWindow SetParent SetWindowLongW SetWindowLongA PostQuitMessage PtInRect GetWindowLongA SetWindowTextW EndDialog IsWindowVisible ShowWindow DialogBoxIndirectParamW MapWindowPoints AdjustWindowRectEx EqualRect DeferWindowPos CreateDialogIndirectParamW DestroyWindow RegisterWindowMessageW CreateWindowExA EnableWindow GetAsyncKeyState MsgWaitForMultipleObjects FindWindowA IsIconic OpenIcon GetForegroundWindow GetActiveWindow GetWindowThreadProcessId AttachThreadInput SetActiveWindow SetForegroundWindow GetParent IsChild GetTopWindow GetCapture WinHelpA GetClassInfoA RegisterClassA GetSubMenu SetPropA UnhookWindowsHookEx GetPropA RemovePropA GetMessageTime GetMessagePos RegisterWindowMessageA ScreenToClient SetWindowPos GetClientRect ClientToScreen PostMessageA SendMessageA CreateWindowExW IsWindow GetWindowRect MoveWindow GetMessageW DispatchMessageW DefWindowProcW GetClassInfoExW RegisterClassExW GetDC ReleaseDC LoadIconA LoadImageA LoadCursorA AppendMenuA IntersectRect PeekMessageA GetMessageA TranslateMessage DispatchMessageA GetCursorPos GetSystemMetrics wsprintfA MessageBoxA GetMenuItemID UnregisterClassA

gdi32

GetStockObject GetTextMetricsA CreateSolidBrush GetObjectW CreatePatternBrush CreateRectRgn GetObjectA PtVisible RectVisible TextOutA Escape SetRectRgn CombineRgn CreatePen Rectangle SetTextColor GetObjectType CreateCompatibleDC SelectObject DeleteDC GetDeviceCaps DeleteObject IntersectClipRect ExcludeClipRect SelectClipRgn ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode CreateFontIndirectA RestoreDC SaveDC CreateRectRgnIndirect PatBlt GetClipBox GetDCOrgEx CreateBitmap GdiFlush CreateFontA CreateEllipticRgn MoveToEx LineTo SetBkColor ExtTextOutA BitBlt CreateCompatibleBitmap SetBkMode CreateDIBSection

advapi32

StartServiceA QueryServiceStatus CloseServiceHandle CreateServiceA OpenServiceA OpenSCManagerA DeleteService CryptDestroyHash CryptGetHashParam CryptHashData CryptCreateHash CryptReleaseContext CryptAcquireContextA RegSetValueExA ControlService RegOpenKeyExA RegCreateKeyExA RegCloseKey

oleaut32

VarUdateFromDate VariantTimeToSystemTime

shlwapi

PathCanonicalizeA PathFindExtensionA SHGetValueA SHSetValueA PathGetDriveNumberA PathAddBackslashA PathRenameExtensionA PathAddExtensionA PathAppendA PathRemoveFileSpecA PathFindFileNameA PathRemoveExtensionA PathRemoveBackslashA PathFileExistsA StrToIntExA SHDeleteKeyA

comdlg32

GetSaveFileNameA GetOpenFileNameA

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

shell32

SHGetSpecialFolderLocation SHGetSpecialFolderPathA DragFinish DragQueryFileA Shell_NotifyIconW ShellExecuteA DragAcceptFiles SHGetFileInfoA

comctl32

InitCommonControlsEx ImageList_SetBkColor ImageList_ReplaceIcon ImageList_Destroy ImageList_Add ImageList_Create _TrackMouseEvent ImageList_GetIcon ord17

ole32

CoInitialize CreateStreamOnHGlobal CLSIDFromString

msimg32

AlphaBlend

wininet

InternetTimeFromSystemTime

gdiplus

GdipDrawArcI GdipDrawString GdipFree GdipDeletePath GdipDrawPath GdipFillPath GdipSetSmoothingMode GdipCreateFromHDC GdiplusStartup GdipMeasureString GdipCreateFromHWND GdipAlloc GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipCreateBitmapFromHBITMAP GdipCloneImage GdipDisposeImage GdipCreateBitmapFromHICON GdipCreateBitmapFromFile GdipCreateBitmapFromFileICM GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipGetImageHeight GdipDeleteGraphics GdipFillRectangleI GdipCreateTexture GdipDrawImageRectRectI GdipCreateHICONFromBitmap GdipSetInterpolationMode GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipAddPathEllipseI GdipCreateLineBrushI GdipAddPathRectangleI GdipCreatePath GdipDeletePen GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDeleteFont GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipGetGenericFontFamilySansSerif GdipSetStringFormatFlags GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipCreateStringFormat GdipClosePathFigure GdipAddPathArcI GdipResetClip GdipFillEllipseI GdipSetClipRectI GdipAddPathArc GdipFillPolygonI GdipDrawLineI GdipSetImageAttributesColorMatrix GdipCreateImageAttributes GdipSetClipPath GdipSetPathGradientSurroundColorsWithCount GdipGetPathGradientPointCount GdipSetPathGradientCenterColor GdipSetPathGradientCenterPointI GdipCreatePathGradientFromPath GdipAddPathPieI GdipDrawEllipseI GdipSetClipHrgn GdipGetImageWidth

winhttp

WinHttpReadData WinHttpQueryHeaders WinHttpCrackUrl WinHttpCloseHandle WinHttpSetCredentials WinHttpSetOption WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpOpen WinHttpConnect WinHttpSetTimeouts

setupapi

SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyA SetupDiGetDeviceInstanceIdA SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA