blackmoon | 2024-05-18_ca9ee38f1e7368b671450b9c2d9732f9_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2024-05-18_ca9ee38f1e7368b671450b9c2d9732f9_mafia
Size 1.6MB
Sample240518-lvbjmaea61
SHA256 8110b111faa3f3afef907a5db770337fd056a21c72467652d28bcb09df4a958b
MD5 ca9ee38f1e7368b671450b9c2d9732f9
SHA1 7afa031905ddf7a96a4a858a295e6c5a5a63cd3d
SHA512 351554627ecf314fbdc8dfba802121c7a926692a9f0d020d094d2e4a385e4bbc2f206556262e8b6bfdb2b69d70c9e12416daa5b90a0c1d0e0a365a5ffa291c8b
SSDEEP 24576:iOQQ5aNHfGVEO/8E+Dr1sEfhR/5OTJ7hIVymFNlMtRVblP9PIjo3rSzp0sUPYudx:iHw58E+1sEZk/I07Szp0sUPYu7UdK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-18_ca9ee38f1e7368b671450b9c2d9732f9_mafia

File Explorer

2024-05-18_ca9ee38f1e7368b671450b9c2d9732f9_mafia

.exe 1.6MB

2024-05-18_ca9ee38f1e7368b671450b9c2d9732f9_mafia

IMPHASH a80097d13f7e0058bb1a805555708354
SHA256 8110b111faa3f3afef907a5db770337fd056a21c72467652d28bcb09df4a958b
MD5 ca9ee38f1e7368b671450b9c2d9732f9
SHA1 7afa031905ddf7a96a4a858a295e6c5a5a63cd3d
SHA512 351554627ecf314fbdc8dfba802121c7a926692a9f0d020d094d2e4a385e4bbc2f206556262e8b6bfdb2b69d70c9e12416daa5b90a0c1d0e0a365a5ffa291c8b
SSDEEP 24576:iOQQ5aNHfGVEO/8E+Dr1sEfhR/5OTJ7hIVymFNlMtRVblP9PIjo3rSzp0sUPYudx:iHw58E+1sEZk/I07Szp0sUPYu7UdK
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detect Blackmoon payload
UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

351526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapQueryInformation LCMapStringA GetCommandLineA GetTickCount GetLocalTime FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileA FindNextFileA GetDiskFreeSpaceExA GetDiskFreeSpaceA MulDiv GetCurrentDirectoryA GetVolumeInformationA GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetUserDefaultLCID GetPrivateProfileStringA GetStartupInfoA CreateProcessA ExitProcess CancelWaitableTimer VirtualAlloc VirtualFree HeapReAlloc FreeLibrary HeapDestroy TryEnterCriticalSection SetCriticalSectionSpinCount DeleteCriticalSection HeapCreate CreateEventA WaitForMultipleObjects SetEvent lstrcpyn RtlMoveMemory InitializeCriticalSectionAndSpinCount GetCurrentProcessId IsWow64Process GetSystemInfo GlobalMemoryStatusEx GetProcessId GetTimeFormatA GetDateFormatA GetLocaleInfoA SetFileAttributesA GetFileAttributesA GetLongPathNameA GetTempPathA GetSystemDirectoryA GetWindowsDirectoryA GetComputerNameA MoveFileA ReadFile GetFileSizeEx WriteFile SetEndOfFile SetFilePointerEx CreateFileA CreateFileW TlsSetValue IsBadReadPtr TlsGetValue GetTempPathW lstrlenW DeleteFileA CreateFileMappingA Process32Next Process32First CreateToolhelp32Snapshot OpenProcess UnmapViewOfFile MapViewOfFile OpenFileMappingA WideCharToMultiByte MultiByteToWideChar GetModuleFileNameA HeapSize GetCurrentProcess TerminateProcess GetProcAddress LoadLibraryA GetModuleHandleA SetThreadAffinityMask HeapFree InterlockedExchange LeaveCriticalSection GetCurrentThreadId WaitForSingleObject SetWaitableTimer CreateWaitableTimerA SwitchToThread InterlockedCompareExchange EnterCriticalSection HeapAlloc GetProcessHeap CloseHandle CreateThread SetProcessDEPPolicy GetProcessVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalFlags LocalReAlloc GlobalReAlloc GlobalHandle InitializeCriticalSection LocalAlloc SetFilePointer GetLastError GetDriveTypeA Sleep lstrcpyA lstrlenA SetLastError lstrcatA QueryPerformanceCounter GetVersion HeapSetInformation GetStartupInfoW EncodePointer DecodePointer RtlUnwind RaiseException SetUnhandledExceptionFilter GetModuleHandleW GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsFree InterlockedIncrement InterlockedDecrement GetSystemTimeAsFileTime UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW VirtualQuery GetStringTypeW LoadLibraryW GetLocaleInfoW SetStdHandle FlushFileBuffers WriteConsoleW EnumSystemLocalesA IsValidLocale lstrcmpiA lstrcmpA GlobalDeleteAtom LocalFree lstrcpynA IsBadReadPtr LCMapStringA LoadLibraryA FreeLibrary GetProcAddress HeapFree HeapAlloc ExitProcess GetProcessHeap GetModuleHandleA GetEnvironmentVariableA VirtualProtectEx RtlMoveMemory

user32

PtInRect GetWindow GetParent PostQuitMessage PostMessageA EnableWindow IsWindowEnabled GetLastActivePopup SetWindowsHookExA CallNextHookEx GetKeyState GetNextDlgTabItem GetFocus EnableMenuItem CheckMenuItem SetMenuItemBitmaps ModifyMenuA GetMenuState LoadBitmapA GetMenuCheckMarkDimensions TabbedTextOutA DrawTextA GrayStringA UnhookWindowsHookEx DestroyWindow GetDlgCtrlID SetWindowTextA GetMenuItemCount RegisterWindowMessageA GetMessagePos GetMessageTime DefWindowProcA RemovePropA CallWindowProcA GetPropA SetPropA GetClassLongA CreateWindowExA GetWindowLongA GetMenuItemID GetSubMenu GetMenu RegisterClassA GetClassInfoA WinHelpA GetCapture GetTopWindow CopyRect AdjustWindowRectEx GetSysColor MapWindowPoints LoadIconA LoadCursorA GetSysColorBrush LoadStringA DestroyMenu EmptyClipboard SetClipboardData MessageBoxA wsprintfA DispatchMessageA TranslateMessage GetMessageA PeekMessageA GetWindowTextA SystemParametersInfoA GetClassNameA SendMessageA SetForegroundWindow SetActiveWindow BringWindowToTop CloseClipboard GetClipboardData OpenClipboard ClientToScreen GetClientRect SetFocus GetWindowThreadProcessId ShowWindowAsync BlockInput FindWindowExA DestroyIcon GetDC FillRect AttachThreadInput SetWindowLongA GetDlgItem SetWindowPos GetAncestor GetForegroundWindow IsWindow MsgWaitForMultipleObjects GetWindowPlacement IsWindowVisible IsIconic DrawIconEx ReleaseDC SendInput GetSystemMetrics MapVirtualKeyA GetLastInputInfo LoadImageA EnumDisplaySettingsA GetWindowRect wsprintfA MessageBoxA

oleaut32

SystemTimeToVariantTime OleLoadPicture VarR8FromCy VarR8FromBool VariantTimeToSystemTime SafeArrayDestroy VariantClear LoadTypeLi LHashValOfNameSys RegisterTypeLi VariantCopy SafeArrayCreate SysAllocString VariantTimeToSystemTime

shlwapi

PathFindFileNameA PathFindExtensionA

gdi32

GetClipBox ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode GetStockObject GetDeviceCaps SetDIBitsToDevice GetDIBits SetPixelV GetPixel GdiFlush BitBlt GetObjectA CreateDIBSection DeleteObject SetTextColor CreateSolidBrush SelectObject CreateCompatibleBitmap CreateCompatibleDC PtVisible RectVisible TextOutA ExtTextOutA Escape SetBkColor RestoreDC SaveDC CreateBitmap DeleteDC

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl CryptAcquireContextA CryptCreateHash CryptReleaseContext CryptHashData CryptDestroyHash CryptGetHashParam RegOpenKeyA RegCloseKey OpenProcessToken GetTokenInformation RegQueryValueExA

shell32

SHGetSpecialFolderPathW ShellExecuteA SHGetSpecialFolderPathA SHGetFileInfoA ShellExecuteExA

ole32

CoCreateGuid CoInitialize OleRun CoInitializeEx CoCreateInstance CLSIDFromString CLSIDFromProgID CreateStreamOnHGlobal CoUninitialize

wininet

HttpSendRequestA HttpSendRequestExA InternetWriteFile InternetSetOptionA InternetReadFile HttpQueryInfoA HttpOpenRequestA InternetCloseHandle InternetConnectA HttpEndRequestA InternetOpenA

msvcrt

strstr malloc free strchr _ftol atoi sprintf

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

comctl32

ord17

generic

count=2, id=14, version=7299,

count=2, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=10, id=152, version=20115,

count=70, id=171, productName=VS2010 build 30319, version=30319,

count=41, id=158, productName=VS2010 build 30319, version=30319,

count=177, id=170, productName=VS2010 build 30319, version=30319,

count=2, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=2, id=93, version=2179,

count=19, id=19, version=8022,

count=22, id=19, version=8034,

count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=559, id=1, productName=Unmarked objects,

count=117, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=72, productName=Unmarked objects (old),

count=18, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=157, productName=VS2010 build 30319, version=30319,