blackmoon | 4c2c88b793777010d2dfb22bb6f5523f[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
4c2c88b793777010d2dfb22bb6f5523f.bin
Size 1.0MB
Sample240611-cmb1razfng
SHA256 bcc016107407463c16cb01dd02fae3300b35efb17ad8e97968f97611b8b93099
MD5 4c2c88b793777010d2dfb22bb6f5523f
SHA1 eca94afd48730f3dd71adefc5a2c9ff5f9a22e70
SHA512 0e4914fa0489c23278dd61408b2d67703a68f6cd8f5c7667fad7885b0580908de0d6d45a99e6d2cd31fb1bcfc74648187663a8252cee8610c01243e2c6d6f040
SSDEEP 24576:fsWgiZ62cLb7JDx44k3GwHiqBxZo60jpbqp:fDcH9D6JPvBxZo6epbqp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c2c88b793777010d2dfb22bb6f5523f.bin

File Explorer

4c2c88b793777010d2dfb22bb6f5523f.bin

.exe 1.0MB

4c2c88b793777010d2dfb22bb6f5523f.bin

IMPHASH 910c6edf80457cf7b9a181bbd24ddddb
SHA256 bcc016107407463c16cb01dd02fae3300b35efb17ad8e97968f97611b8b93099
MD5 4c2c88b793777010d2dfb22bb6f5523f
SHA1 eca94afd48730f3dd71adefc5a2c9ff5f9a22e70
SHA512 0e4914fa0489c23278dd61408b2d67703a68f6cd8f5c7667fad7885b0580908de0d6d45a99e6d2cd31fb1bcfc74648187663a8252cee8610c01243e2c6d6f040
SSDEEP 24576:fsWgiZ62cLb7JDx44k3GwHiqBxZo60jpbqp:fDcH9D6JPvBxZo6epbqp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect Blackmoon payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

48252

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateEventA GetFileType GetEnvironmentVariableA GetVersionExA HeapFree HeapDestroy HeapCreate VirtualFree CreateToolhelp32Snapshot Process32First CloseHandle Process32Next GetTickCount lstrlenW WideCharToMultiByte VirtualAlloc IsBadWritePtr LCMapStringW SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW IsBadCodePtr SetStdHandle GetCurrentThreadId GetModuleHandleA GetProcAddress lstrcpyn CreateWaitableTimerA SetWaitableTimer LocalAlloc LocalFree GetProcessHeap ExitProcess HeapAlloc HeapReAlloc LCMapStringA LoadLibraryA FreeLibrary GetCommandLineA GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetUserDefaultLCID MultiByteToWideChar GetFileSize ReadFile GetStartupInfoA CreateProcessA WaitForSingleObject CreateFileA WriteFile GetModuleFileNameA IsBadReadPtr SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetACP HeapSize RaiseException GetStdHandle OpenEventA TerminateProcess RtlUnwind GetOEMCP GetCPInfo FlushFileBuffers SetFilePointer GetCurrentProcess SetErrorMode GetProcessVersion FindResourceA LoadResource LockResource GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GetLastError SetLastError InterlockedIncrement lstrcpyA lstrcatA WritePrivateProfileStringA InterlockedDecrement CreateThread InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThread lstrcmpiA lstrcmpA GlobalDeleteAtom lstrlenA TlsAlloc GlobalHandle TlsFree GlobalReAlloc TlsSetValue LocalReAlloc TlsGetValue lstrcpynA MulDiv GlobalFlags

ws2_32

ioctlsocket closesocket connect inet_addr shutdown htons setsockopt socket select WSAStartup

user32

AdjustWindowRectEx IsWindow IsWindowVisible EndDialog CreateDialogIndirectParamA DestroyMenu PostThreadMessageA UnregisterClassA LoadStringA GetSysColorBrush LoadCursorA LoadIconA UpdateWindow MapWindowPoints PeekMessageA GetMessageA TranslateMessage DispatchMessageA wsprintfA MessageBoxA MsgWaitForMultipleObjects SetActiveWindow AttachThreadInput OpenIcon IsIconic SetWindowPos GetWindowTextW GetWindowTextLengthW GetClassNameA GetParent GetWindowThreadProcessId FindWindowExA PostQuitMessage PostMessageA SendMessageA SetCursor EnableWindow GetWindowLongA IsWindowEnabled GetLastActivePopup SetWindowsHookExA GetCursorPos ValidateRect CallNextHookEx GetKeyState GetActiveWindow GetNextDlgTabItem GetFocus EnableMenuItem CheckMenuItem SetMenuItemBitmaps ModifyMenuA GetMenuState LoadBitmapA GetMenuCheckMarkDimensions RegisterClipboardFormatA PtInRect GetWindowRect GetDlgCtrlID GetWindow ClientToScreen SetWindowTextA GetWindowTextA UnhookWindowsHookEx GetMenuItemCount GetDC ReleaseDC TabbedTextOutA DrawTextA GrayStringA GetDlgItem SendDlgItemMessageA IsDialogMessageA SetWindowLongA ShowWindow SetFocus GetSystemMetrics GetWindowPlacement SystemParametersInfoA RegisterWindowMessageA SetForegroundWindow GetForegroundWindow GetMessagePos GetMessageTime DefWindowProcA RemovePropA CallWindowProcA GetPropA SetPropA GetClassLongA CreateWindowExA DestroyWindow GetMenuItemID GetSubMenu GetMenu RegisterClassA GetClassInfoA WinHelpA GetCapture GetTopWindow CopyRect GetClientRect GetSysColor

advapi32

RegCreateKeyExA CryptGetHashParam CryptDestroyHash CryptHashData CryptReleaseContext CryptCreateHash CryptAcquireContextA RegCloseKey RegOpenKeyExA RegSetValueExA

ole32

CLSIDFromProgID CLSIDFromString CoCreateInstance OleRun CoInitialize CoUninitialize OleInitialize OleUninitialize CoFreeUnusedLibraries CoRegisterMessageFilter CoRevokeClassObject OleFlushClipboard OleIsCurrentClipboard

gdi32

SelectObject Escape ExtTextOutA TextOutA RectVisible PtVisible GetDeviceCaps GetClipBox ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetTextColor SetBkColor RestoreDC SaveDC DeleteDC DeleteObject GetObjectA GetStockObject CreateBitmap

winspool.drv

OpenPrinterA ClosePrinter DocumentPropertiesA

comctl32

ord17

oledlg

ord8

oleaut32

SafeArrayDestroy VariantClear SysAllocString SafeArrayCreate VariantCopy LoadTypeLi LHashValOfNameSys RegisterTypeLi

shlwapi

PathFileExistsA