blackmoon | a04f47dbdfa18399fe3017963b0108de781855ea1fbf966c067cf4972fbab493

Sharing

Copy URL Twitter E-mail

General

Target
a04f47dbdfa18399fe3017963b0108de781855ea1fbf966c067cf4972fbab493
Size 900KB
Sample240611-bml1aayfpr
SHA256 a04f47dbdfa18399fe3017963b0108de781855ea1fbf966c067cf4972fbab493
MD5 b8d31af7c83c18a247456eb2505d10bc
SHA1 ee60cd203b7e7f0c804cfdee235488e2dbe386d7
SHA512 181aa3ec0bf10dfb208b97f68c274f2aba340cfee77bab0f0dd9a5d4627a64e8e79118424271fdcde6a5daef0d868d00bbdb5a4f0fe9db5e6008a494bd5e5058
SSDEEP 24576:kkDcMmMXMa3RygcbUnqtUR8gcACjkv37S66hNL3zjY/:1DcMvJ3ujXtDja
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a04f47dbdfa18399fe3017963b0108de781855ea1fbf966c067cf4972fbab493

File Explorer

a04f47dbdfa18399fe3017963b0108de781855ea1fbf966c067cf4972fbab493

.dll 900KB

a04f47dbdfa18399fe3017963b0108de781855ea1fbf966c067cf4972fbab493

IMPHASH 3c5cc2cc020bd29f9e70a110b3818306
SHA256 a04f47dbdfa18399fe3017963b0108de781855ea1fbf966c067cf4972fbab493
MD5 b8d31af7c83c18a247456eb2505d10bc
SHA1 ee60cd203b7e7f0c804cfdee235488e2dbe386d7
SHA512 181aa3ec0bf10dfb208b97f68c274f2aba340cfee77bab0f0dd9a5d4627a64e8e79118424271fdcde6a5daef0d868d00bbdb5a4f0fe9db5e6008a494bd5e5058
SSDEEP 24576:kkDcMmMXMa3RygcbUnqtUR8gcACjkv37S66hNL3zjY/:1DcMvJ3ujXtDja
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect Blackmoon payload
UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

589040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetTempFileNameA GetSystemDirectoryA MultiByteToWideChar ReleaseMutex CreateMutexA lstrcpynA CreateThread GetCurrentProcessId OutputDebugStringA CreateWaitableTimerA SetWaitableTimer CancelWaitableTimer GetCurrentThreadId CreateRemoteThread ReadProcessMemory OpenProcess WriteProcessMemory VirtualFreeEx ResumeThread WaitForSingleObject CloseHandle RtlMoveMemory Beep GetVersionExA GetTempPathA GetLogicalDriveStringsA QueryDosDeviceA GetProcessHeap WideCharToMultiByte ExitProcess HeapAlloc HeapReAlloc HeapFree IsBadReadPtr GetModuleFileNameA WriteFile CreateFileA GetTickCount ReadFile GetFileSize DeleteFileA Sleep GlobalUnlock GlobalLock GlobalAlloc MulDiv GetDiskFreeSpaceA GetCurrentDirectoryA GetCommandLineA FreeLibrary LCMapStringA TerminateThread LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection VirtualAllocEx GetProcAddress CopyFileA LoadLibraryA VirtualFree GetModuleHandleA VirtualAlloc

user32

OpenClipboard EmptyClipboard SetClipboardData CloseClipboard PeekMessageA GetMessageA TranslateMessage DispatchMessageA wsprintfA SendMessageA SetWindowLongA CallWindowProcA RegisterWindowMessageA IsWindow MapVirtualKeyA PostMessageA SetCursorPos GetParent GetWindowInfo ScreenToClient GetWindowThreadProcessId SetForegroundWindow SwitchToThisWindow MessageBoxTimeoutA MessageBoxA PostThreadMessageA CallNextHookEx SetWindowTextA GetWindowTextLengthA MsgWaitForMultipleObjects GetWindowTextA GetCursorPos

shlwapi

PathFileExistsA StrToIntExA PathFindFileNameA

msvcrt

_except_handler3 _stricmp __CxxFrameHandler strncmp memmove realloc strchr _CIpow strtod rand malloc modf floor _ftol sprintf srand atoi _CIfmod ??3@YAXPAX@Z strrchr ??2@YAPAXI@Z free

advapi32

RegCloseKey RegCreateKeyExA RegSetValueExA