blackmoon | 2024-06-21_c31ed1c9d387878c21458bdef6d3260c_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-21_c31ed1c9d387878c21458bdef6d3260c_mafia
Size 1.3MB
Sample240621-jebtca1dng
SHA256 c0aabb3c79a97eabff16d4e215e403f80fadee5d63a54dd7433f0f5125bca4ad
MD5 c31ed1c9d387878c21458bdef6d3260c
SHA1 f4b34b042a130701c96409c9a2057c37f195424e
SHA512 48419ae59c8b1705656f63886d509fc34081ff44998ffe5336f9b6e76b125c42528b8762cf9d75d09359768f3c1a9c2418478d35fe5c94d8b904e2ae86d5b256
SSDEEP 24576:R1UGLrmwPVsjEkazzCmRpslRI4/iK6LfGJErGCkfp0sUPYud9mj1uRyRsGyz:Ru2jkaqmRpwOOiMeGPfp0sUPYu7UQq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-21_c31ed1c9d387878c21458bdef6d3260c_mafia

File Explorer

2024-06-21_c31ed1c9d387878c21458bdef6d3260c_mafia

.exe 1.3MB

2024-06-21_c31ed1c9d387878c21458bdef6d3260c_mafia

IMPHASH 3de9f24603dcb1035ffa9736c3f2f4ba
SHA256 c0aabb3c79a97eabff16d4e215e403f80fadee5d63a54dd7433f0f5125bca4ad
MD5 c31ed1c9d387878c21458bdef6d3260c
SHA1 f4b34b042a130701c96409c9a2057c37f195424e
SHA512 48419ae59c8b1705656f63886d509fc34081ff44998ffe5336f9b6e76b125c42528b8762cf9d75d09359768f3c1a9c2418478d35fe5c94d8b904e2ae86d5b256
SSDEEP 24576:R1UGLrmwPVsjEkazzCmRpslRI4/iK6LfGJErGCkfp0sUPYud9mj1uRyRsGyz:Ru2jkaqmRpwOOiMeGPfp0sUPYu7UQq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detect Blackmoon payload
UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

332390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapQueryInformation LCMapStringA GetCommandLineA GetTickCount WritePrivateProfileStringA GetLocalTime FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileA FindNextFileA GetDiskFreeSpaceExA GetDiskFreeSpaceA MulDiv GetCurrentDirectoryA GetVolumeInformationA GetPrivateProfileStringA GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetUserDefaultLCID GetStartupInfoA CreateProcessA ExitProcess CancelWaitableTimer VirtualAlloc VirtualFree TryEnterCriticalSection CreateEventA WaitForMultipleObjects SetEvent HeapReAlloc HeapDestroy DeleteCriticalSection FreeLibrary SetCriticalSectionSpinCount HeapCreate lstrcpyn RtlMoveMemory GlobalMemoryStatusEx GetProcessId GetTimeFormatA GetDateFormatA GetLocaleInfoA GetComputerNameA MoveFileA ReadFile GetFileSizeEx WriteFile SetEndOfFile SetFilePointerEx CreateFileA CreateFileW TlsSetValue IsBadReadPtr TlsGetValue DeleteFileA GetTempPathW lstrlenW SetFileAttributesA GetFileAttributesA GetLongPathNameA GetTempPathA GetSystemDirectoryA GetWindowsDirectoryA CreateFileMappingA Process32Next Process32First CreateToolhelp32Snapshot OpenProcess UnmapViewOfFile MapViewOfFile OpenFileMappingA WideCharToMultiByte MultiByteToWideChar GetModuleFileNameA HeapSize TerminateProcess SetThreadAffinityMask HeapFree InterlockedExchange LeaveCriticalSection WaitForSingleObject SetWaitableTimer CreateWaitableTimerA SwitchToThread InterlockedCompareExchange EnterCriticalSection CloseHandle CreateThread SetProcessDEPPolicy HeapAlloc GetProcessHeap InitializeCriticalSectionAndSpinCount GetCurrentProcessId GetCurrentThreadId GetProcAddress LoadLibraryA GetModuleHandleA IsWow64Process GetCurrentProcess GetSystemInfo GetProcessVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA SetFilePointer GetLastError GetDriveTypeA Sleep lstrcpyA lstrlenA SetLastError lstrcatA QueryPerformanceCounter GetVersion HeapSetInformation GetStartupInfoW EncodePointer DecodePointer RtlUnwind RaiseException SetUnhandledExceptionFilter GetModuleHandleW GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsFree InterlockedIncrement InterlockedDecrement GetSystemTimeAsFileTime UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW VirtualQuery GetStringTypeW LoadLibraryW GetLocaleInfoW SetStdHandle FlushFileBuffers WriteConsoleW EnumSystemLocalesA IsValidLocale lstrcmpiA lstrcmpA GlobalDeleteAtom LocalFree lstrcpynA LocalAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc LocalReAlloc GlobalFlags GetModuleHandleA GetProcessHeap HeapAlloc HeapFree RtlMoveMemory GetProcAddress FreeLibrary LoadLibraryA VirtualProtectEx LCMapStringA IsBadReadPtr GetEnvironmentVariableA ExitProcess

user32

CallNextHookEx GetKeyState GetNextDlgTabItem GetFocus EnableMenuItem CheckMenuItem SetMenuItemBitmaps ModifyMenuA GetMenuState LoadBitmapA GetMenuCheckMarkDimensions TabbedTextOutA DrawTextA GrayStringA UnhookWindowsHookEx DestroyWindow GetDlgCtrlID SetWindowTextA GetMenuItemCount GetWindowPlacement RegisterWindowMessageA GetMessagePos GetMessageTime DefWindowProcA RemovePropA CallWindowProcA GetPropA SetPropA GetClassLongA CreateWindowExA GetMenuItemID GetSubMenu GetMenu RegisterClassA GetClassInfoA WinHelpA SetWindowsHookExA GetTopWindow CopyRect AdjustWindowRectEx GetSysColor MapWindowPoints LoadIconA LoadCursorA GetSysColorBrush LoadStringA DestroyMenu SetActiveWindow GetLastActivePopup IsWindowEnabled EnableWindow SetForegroundWindow SetFocus GetWindowThreadProcessId ShowWindowAsync PostMessageA PostQuitMessage MsgWaitForMultipleObjects IsWindow FindWindowExA DestroyIcon GetForegroundWindow GetDC FillRect DrawIconEx ReleaseDC SendInput GetSystemMetrics MapVirtualKeyA GetLastInputInfo LoadImageA EnumDisplaySettingsA IsIconic IsWindowVisible GetWindowRect GetClientRect ClientToScreen OpenClipboard GetClipboardData GetAncestor CloseClipboard EmptyClipboard SetClipboardData MessageBoxA wsprintfA DispatchMessageA TranslateMessage GetMessageA PeekMessageA GetParent GetWindow PtInRect GetWindowLongA GetWindowTextA SetWindowPos AttachThreadInput SetWindowLongA GetDlgItem SystemParametersInfoA GetClassNameA SendMessageA GetCapture BringWindowToTop MessageBoxA wsprintfA

oleaut32

SafeArrayDestroy VariantClear SysAllocString SafeArrayCreate VariantCopy RegisterTypeLi LHashValOfNameSys LoadTypeLi SystemTimeToVariantTime OleLoadPicture VarR8FromCy VarR8FromBool VariantTimeToSystemTime VariantTimeToSystemTime

shlwapi

PathFindExtensionA PathFindFileNameA

gdi32

GetClipBox ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode GetStockObject GetDeviceCaps SetDIBitsToDevice GetDIBits SetPixelV GetPixel GdiFlush BitBlt GetObjectA CreateDIBSection SetTextColor DeleteDC CreateSolidBrush SelectObject CreateCompatibleBitmap CreateCompatibleDC PtVisible RectVisible TextOutA ExtTextOutA Escape SetBkColor RestoreDC SaveDC CreateBitmap DeleteObject

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl CryptAcquireContextA CryptCreateHash CryptReleaseContext CryptHashData CryptDestroyHash CryptGetHashParam RegOpenKeyA RegCloseKey OpenProcessToken GetTokenInformation RegQueryValueExA

shell32

ShellExecuteExA SHGetFileInfoA ShellExecuteA SHGetSpecialFolderPathW SHGetSpecialFolderPathA

ole32

CoInitializeEx CoUninitialize CoCreateGuid CoInitialize OleRun CoCreateInstance CLSIDFromString CLSIDFromProgID CreateStreamOnHGlobal

msvcrt

sprintf atoi _ftol strchr free malloc strstr

winspool.drv

OpenPrinterA ClosePrinter DocumentPropertiesA

comctl32

ord17

generic

count=2, id=14, version=7299,

count=2, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=11, id=152, version=20115,

count=70, id=171, productName=VS2010 build 30319, version=30319,

count=41, id=158, productName=VS2010 build 30319, version=30319,

count=177, id=170, productName=VS2010 build 30319, version=30319,

count=2, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=2, id=93, version=2179,

count=19, id=19, version=8022,

count=22, id=19, version=8034,

count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=558, id=1, productName=Unmarked objects,

count=119, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=63, productName=Unmarked objects (old),

count=18, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=157, productName=VS2010 build 30319, version=30319,