blackmoon | d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5

General

Target

d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5
Size

6.4MB
MD5

9285ae62b4ce7e9d87a915fd62dfd031
SHA1

5704c99b6fe70fb74480f8261c441109c26d7753
SHA256

d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5
SHA512

8b513989b8851d5b13dc639c0e8022849e027cc35609b20fca7f52f36cb56472c6e6ebf119b8bb21dcae065172bc31e37e8a46f60a7d167c73ac088ea1ff46d6
SSDEEP

98304:T/WXTBJYaVmknGzZr+H3O5SEPFtmOb9G1u5v/nZVnivsAl0kroSCa:KXTYimknGzwH3OgEPH39JX/nivPli

Score

10^/10

Blackmoon family
blackmoon
Detect Blackmoon payload 1 IoCs

Processes:

resource yara_rule

sample family_blackmoon
Mimikatz family
mimikatz
UPX dump on OEP (original entry point) 1 IoCs

Processes:

resource yara_rule

sample UPX
mimikatz is an open source tool to dump credentials on Windows 1 IoCs

Processes:

resource yara_rule

sample mimikatz

resource	yara_rule
sample	family_blackmoon

resource	yara_rule
sample	UPX

resource	yara_rule
sample	mimikatz

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5

NSIS installer 1 IoCs
installer

Processes:

resource yara_rule

sample nsis_installer_2

resource	yara_rule
sample	nsis_installer_2