blackmoon | 2024-06-07_065109a30a099852d4f95efd2740a825_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-07_065109a30a099852d4f95efd2740a825_mafia
Size 1.6MB
Sample240607-pyg3csgb7w
SHA256 eff437d684be722337ef3ceca10468b8b3574dab1d2975ce75202767e5d21a89
MD5 065109a30a099852d4f95efd2740a825
SHA1 7678b75cb9c90de25e3ae241ecb626f798742561
SHA512 7b39067204e37f5aca8ca74306a11c8403a3e2d9ff4324b3ff83abe7dd851d3ddc8c4bf434d70e4d6eb02954ffc89492095d98452af25cac47a5c737bab6d0b7
SSDEEP 24576:f1mxoao8V+vwdPRcr3QtIfRR55OTJ7hIVymFNlMtRVblP9PIjo3rSCp0sUPYud9g:fQJdPRc0tIpO/I07SCp0sUPYu7U0K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-07_065109a30a099852d4f95efd2740a825_mafia

File Explorer

2024-06-07_065109a30a099852d4f95efd2740a825_mafia

.exe 1.6MB

2024-06-07_065109a30a099852d4f95efd2740a825_mafia

IMPHASH a80097d13f7e0058bb1a805555708354
SHA256 eff437d684be722337ef3ceca10468b8b3574dab1d2975ce75202767e5d21a89
MD5 065109a30a099852d4f95efd2740a825
SHA1 7678b75cb9c90de25e3ae241ecb626f798742561
SHA512 7b39067204e37f5aca8ca74306a11c8403a3e2d9ff4324b3ff83abe7dd851d3ddc8c4bf434d70e4d6eb02954ffc89492095d98452af25cac47a5c737bab6d0b7
SSDEEP 24576:f1mxoao8V+vwdPRcr3QtIfRR55OTJ7hIVymFNlMtRVblP9PIjo3rSCp0sUPYud9g:fQJdPRc0tIpO/I07SCp0sUPYu7U0K
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detect Blackmoon payload
UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

352678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapQueryInformation LCMapStringA GetCommandLineA GetTickCount GetLocalTime FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileA FindNextFileA GetDiskFreeSpaceExA GetDiskFreeSpaceA MulDiv GetCurrentDirectoryA GetVolumeInformationA GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetUserDefaultLCID GetPrivateProfileStringA GetStartupInfoA CreateProcessA ExitProcess CancelWaitableTimer VirtualAlloc VirtualFree HeapReAlloc FreeLibrary HeapDestroy TryEnterCriticalSection SetCriticalSectionSpinCount DeleteCriticalSection HeapCreate CreateEventA WaitForMultipleObjects SetEvent lstrcpyn RtlMoveMemory InitializeCriticalSectionAndSpinCount GetCurrentProcessId IsWow64Process GetSystemInfo GlobalMemoryStatusEx GetProcessId GetTimeFormatA GetDateFormatA GetLocaleInfoA SetFileAttributesA GetFileAttributesA GetLongPathNameA GetTempPathA GetSystemDirectoryA GetWindowsDirectoryA GetComputerNameA MoveFileA ReadFile GetFileSizeEx WriteFile SetEndOfFile SetFilePointerEx CreateFileA CreateFileW TlsSetValue IsBadReadPtr TlsGetValue GetTempPathW lstrlenW DeleteFileA CreateFileMappingA Process32Next Process32First CreateToolhelp32Snapshot OpenProcess UnmapViewOfFile MapViewOfFile OpenFileMappingA WideCharToMultiByte MultiByteToWideChar GetModuleFileNameA HeapSize GetCurrentProcess TerminateProcess GetProcAddress LoadLibraryA GetModuleHandleA SetThreadAffinityMask HeapFree InterlockedExchange LeaveCriticalSection GetCurrentThreadId WaitForSingleObject SetWaitableTimer CreateWaitableTimerA SwitchToThread InterlockedCompareExchange EnterCriticalSection HeapAlloc GetProcessHeap CloseHandle CreateThread SetProcessDEPPolicy GetProcessVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalFlags LocalReAlloc GlobalReAlloc GlobalHandle InitializeCriticalSection LocalAlloc SetFilePointer GetLastError GetDriveTypeA Sleep lstrcpyA lstrlenA SetLastError lstrcatA QueryPerformanceCounter GetVersion HeapSetInformation GetStartupInfoW EncodePointer DecodePointer RtlUnwind RaiseException SetUnhandledExceptionFilter GetModuleHandleW GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsFree InterlockedIncrement InterlockedDecrement GetSystemTimeAsFileTime UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW VirtualQuery GetStringTypeW LoadLibraryW GetLocaleInfoW SetStdHandle FlushFileBuffers WriteConsoleW EnumSystemLocalesA IsValidLocale lstrcmpiA lstrcmpA GlobalDeleteAtom LocalFree lstrcpynA IsBadReadPtr LCMapStringA LoadLibraryA FreeLibrary GetProcAddress HeapFree HeapAlloc ExitProcess GetProcessHeap GetModuleHandleA GetEnvironmentVariableA VirtualProtectEx RtlMoveMemory

user32

PtInRect GetWindow GetParent PostQuitMessage PostMessageA EnableWindow IsWindowEnabled GetLastActivePopup SetWindowsHookExA CallNextHookEx GetKeyState GetNextDlgTabItem GetFocus EnableMenuItem CheckMenuItem SetMenuItemBitmaps ModifyMenuA GetMenuState LoadBitmapA GetMenuCheckMarkDimensions TabbedTextOutA DrawTextA GrayStringA UnhookWindowsHookEx DestroyWindow GetDlgCtrlID SetWindowTextA GetMenuItemCount RegisterWindowMessageA GetMessagePos GetMessageTime DefWindowProcA RemovePropA CallWindowProcA GetPropA SetPropA GetClassLongA CreateWindowExA GetWindowLongA GetMenuItemID GetSubMenu GetMenu RegisterClassA GetClassInfoA WinHelpA GetCapture GetTopWindow CopyRect AdjustWindowRectEx GetSysColor MapWindowPoints LoadIconA LoadCursorA GetSysColorBrush LoadStringA DestroyMenu EmptyClipboard SetClipboardData MessageBoxA wsprintfA DispatchMessageA TranslateMessage GetMessageA PeekMessageA GetWindowTextA SystemParametersInfoA GetClassNameA SendMessageA SetForegroundWindow SetActiveWindow BringWindowToTop CloseClipboard GetClipboardData OpenClipboard ClientToScreen GetClientRect SetFocus GetWindowThreadProcessId ShowWindowAsync BlockInput FindWindowExA DestroyIcon GetDC FillRect AttachThreadInput SetWindowLongA GetDlgItem SetWindowPos GetAncestor GetForegroundWindow IsWindow MsgWaitForMultipleObjects GetWindowPlacement IsWindowVisible IsIconic DrawIconEx ReleaseDC SendInput GetSystemMetrics MapVirtualKeyA GetLastInputInfo LoadImageA EnumDisplaySettingsA GetWindowRect wsprintfA MessageBoxA

oleaut32

SystemTimeToVariantTime OleLoadPicture VarR8FromCy VarR8FromBool VariantTimeToSystemTime SafeArrayDestroy VariantClear LoadTypeLi LHashValOfNameSys RegisterTypeLi VariantCopy SafeArrayCreate SysAllocString VariantTimeToSystemTime

shlwapi

PathFindFileNameA PathFindExtensionA

gdi32

GetClipBox ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode GetStockObject GetDeviceCaps SetDIBitsToDevice GetDIBits SetPixelV GetPixel GdiFlush BitBlt GetObjectA CreateDIBSection DeleteObject SetTextColor CreateSolidBrush SelectObject CreateCompatibleBitmap CreateCompatibleDC PtVisible RectVisible TextOutA ExtTextOutA Escape SetBkColor RestoreDC SaveDC CreateBitmap DeleteDC

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl CryptAcquireContextA CryptCreateHash CryptReleaseContext CryptHashData CryptDestroyHash CryptGetHashParam RegOpenKeyA RegCloseKey OpenProcessToken GetTokenInformation RegQueryValueExA

shell32

SHGetSpecialFolderPathW ShellExecuteA SHGetSpecialFolderPathA SHGetFileInfoA ShellExecuteExA

ole32

CoCreateGuid CoInitialize OleRun CoInitializeEx CoCreateInstance CLSIDFromString CLSIDFromProgID CreateStreamOnHGlobal CoUninitialize

wininet

HttpSendRequestA HttpSendRequestExA InternetWriteFile InternetSetOptionA InternetReadFile HttpQueryInfoA HttpOpenRequestA InternetCloseHandle InternetConnectA HttpEndRequestA InternetOpenA

msvcrt

strstr malloc free strchr _ftol atoi sprintf

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

comctl32

ord17

generic

count=2, id=14, version=7299,

count=2, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=10, id=152, version=20115,

count=70, id=171, productName=VS2010 build 30319, version=30319,

count=41, id=158, productName=VS2010 build 30319, version=30319,

count=177, id=170, productName=VS2010 build 30319, version=30319,

count=2, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=2, id=93, version=2179,

count=19, id=19, version=8022,

count=22, id=19, version=8034,

count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=559, id=1, productName=Unmarked objects,

count=117, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=72, productName=Unmarked objects (old),

count=18, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=157, productName=VS2010 build 30319, version=30319,