blackmoon | 0167ba9a163050255f6be052a73b0c1370b85f91c6d11251b5fc4a50f095ece9

Sharing

Copy URL

Twitter E-mail

General

Target

0167ba9a163050255f6be052a73b0c1370b85f91c6d11251b5fc4a50f095ece9
Size

2.1MB
MD5

34b87ce49226dbfdf19f3aad911993e8
SHA1

8cdee2c41ed9da3e2a8f118b3de2d2a97a50489e
SHA256

0167ba9a163050255f6be052a73b0c1370b85f91c6d11251b5fc4a50f095ece9
SHA512

9d7f9953e54363a6eede21d32fb496e9685898eda22661aad1e931e9c13cc59bad00d383e08d813d6aa417c66d1e403d41e309288cc4da4779fdddf30853f74e
SSDEEP

24576:8H0bn8L6SMO787qCLCn/5CR7hs7ZUGqX/sQk3wjcw99/4EhntxmOzAmSpETzqic+:8HDv/5ChhspCjcQ/nUyqiu1lW

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0167ba9a163050255f6be052a73b0c1370b85f91c6d11251b5fc4a50f095ece9

Files

0167ba9a163050255f6be052a73b0c1370b85f91c6d11251b5fc4a50f095ece9
.exe windows:4 windows x86 arch:x86

0146d5990f5d45e64354f084798f40ad

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsA

ws2_32

WSACleanup
WSAStartup
gethostbyname
gethostname

kernel32

InterlockedExchange
VirtualProtect
VirtualQuery
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
LCMapStringA
FreeLibrary
GetCommandLineA
CreateDirectoryA
GetUserDefaultLCID
SetFilePointer
SetFileAttributesA
GetDiskFreeSpaceA
MulDiv
GetCurrentDirectoryA
GetDiskFreeSpaceExA
GetFileAttributesA
Sleep
FindFirstFileA
RemoveDirectoryA
FindNextFileA
FindClose
DeleteFileA
GetFileSize
ReadFile
CreateFileA
WriteFile
GetModuleFileNameA
IsBadReadPtr
HeapReAlloc
ExitProcess
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
HeapFree
GetEnvironmentVariableA
WaitForSingleObject
SetStdHandle
SetThreadContext
VirtualProtectEx
GetThreadContext
LocalSize
Module32First
CreateToolhelp32Snapshot
ReadProcessMemory
ResumeThread
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
CreateProcessA
SetLastError
VirtualQueryEx
LocalFree
LocalAlloc
QueryDosDeviceA
GetLogicalDriveStringsA
CloseHandle
GlobalSize
GlobalUnlock
GlobalLock
GetCurrentProcess
GetTickCount
TlsGetValue
GlobalFree
GlobalAlloc
GetNativeSystemInfo
GetProcAddress
GetModuleHandleA
IsBadCodePtr
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
LCMapStringW
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetACP
HeapSize
RaiseException
RtlUnwind
GetStartupInfoA
GetOEMCP
GetCPInfo
SetErrorMode
GetProcessVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
WritePrivateProfileStringA
GlobalFlags
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
QueryPerformanceCounter
QueryPerformanceFrequency
HeapAlloc
GetProcessHeap
RtlMoveMemory
IsWow64Process
GetSystemInfo
GetVersionExA
lstrcpyn
GetLastError
TerminateProcess
OpenProcess
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryA
GetCurrentProcessId
InterlockedCompareExchange
Process32Next
Process32First
GetDriveTypeA
GlobalMemoryStatus
lstrcpyA
lstrlenA
lstrcatA
LockResource
LoadResource
FindResourceA
GetVersion
CreateThread
DeleteCriticalSection
TerminateThread
SetSystemPowerState
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
InterlockedIncrement
InterlockedDecrement
FlushFileBuffers
SetEndOfFile
lstrcpynA
GetStringTypeExA

user32

IsWindow
SystemParametersInfoA
UpdateWindow
GetDlgItem
GetCursorPos
FindWindowExA
PtInRect
GetParent
EnableWindow
IsWindowEnabled
GetForegroundWindow
GetActiveWindow
SetActiveWindow
ExitWindowsEx
PostMessageA
SetCursor
GetLastActivePopup
SetWindowsHookExA
ValidateRect
CallNextHookEx
GetKeyState
GetNextDlgTabItem
GetFocus
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
TabbedTextOutA
DrawTextA
GrayStringA
UnhookWindowsHookEx
CreateDialogIndirectParamA
EndDialog
GetDlgCtrlID
SetWindowTextA
GetMenuItemCount
SendDlgItemMessageA
IsDialogMessageA
SetWindowPos
SetFocus
GetWindowPlacement
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
UnregisterClassA
PostThreadMessageA
DestroyMenu
EnumDisplaySettingsA
IsIconic
IsWindowVisible
PrintWindow
GetClientRect
ClientToScreen
OpenClipboard
SetWindowLongA
GetClipboardData
SetForegroundWindow
GetWindowLongA
LoadImageA
SendMessageA
PostQuitMessage
DestroyWindow
GetSystemMetrics
GetLastInputInfo
EnumWindows
GetWindowThreadProcessId
GetWindowTextLengthA
GetWindowTextA
GetClassNameA
DestroyIcon
GetDC
FillRect
DrawIconEx
ReleaseDC
ShowWindow
SetTimer
GetWindowRect
GetWindow
CloseClipboard
EmptyClipboard
SetClipboardData
MessageBoxA
wsprintfA
DispatchMessageA
GetMessageA
EnumChildWindows
KillTimer
CallWindowProcA
PeekMessageW
TranslateMessage
DispatchMessageW
SendMessageW
GetWindowTextLengthW
GetWindowTextW
GetDesktopWindow
PeekMessageA
SetWindowTextW

gdi32

GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
GetStockObject
SetStretchBltMode
StretchBlt
SetDIBitsToDevice
GetDIBits
SetPixelV
GetPixel
GdiFlush
BitBlt
CreateDIBSection
GetObjectA
DeleteObject
DeleteDC
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
CreateBitmap
GetDeviceCaps
CreateSolidBrush

advapi32

GetUserNameA
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
LookupAccountSidA
RegOpenKeyA
RegSetValueExA
RegCreateKeyExA

shell32

SHGetSpecialFolderPathA
SHGetFileInfoA
SHFormatDrive
ShellExecuteA

ole32

CoInitialize
OleRun
GetHGlobalFromStream
CoCreateInstance
CLSIDFromString
CoUninitialize
CLSIDFromProgID
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
OleInitialize
CreateStreamOnHGlobal

wininet

InternetCloseHandle
InternetReadFile
HttpQueryInfoA
InternetOpenUrlA
InternetOpenA
InternetGetConnectedStateEx

gdiplus

GdiplusShutdown
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream
GdiplusStartup
GdipSaveImageToStream

psapi

GetProcessImageFileNameA

iphlpapi

GetAdaptersInfo

oledlg

ord8

oleaut32

SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
VarR8FromCy
VarR8FromBool
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

comctl32

ord17

Sections

.text
Size: 512KB - Virtual size: 511KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.5MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0146d5990f5d45e64354f084798f40ad

Headers

File Characteristics

Imports

shlwapi

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

wininet

gdiplus

psapi

iphlpapi

oledlg

oleaut32

winspool.drv

comctl32

Sections

.text Size: 512KB - Virtual size: 511KB

.rdata Size: 36KB - Virtual size: 33KB

.data Size: 1.5MB - Virtual size: 1.7MB

.rsrc Size: 56KB - Virtual size: 52KB

.text
Size: 512KB - Virtual size: 511KB

.rdata
Size: 36KB - Virtual size: 33KB

.data
Size: 1.5MB - Virtual size: 1.7MB

.rsrc
Size: 56KB - Virtual size: 52KB