blackmoon | e5af3b8208bb4097cb986c3ee1d6152698a52ebf124f25de964927d24516669c

Sharing

Copy URL Twitter E-mail

General

Target
e5af3b8208bb4097cb986c3ee1d6152698a52ebf124f25de964927d24516669c
Size 176KB
Sample240621-px2elstfpn
SHA256 e5af3b8208bb4097cb986c3ee1d6152698a52ebf124f25de964927d24516669c
MD5 d8fb66eba757ede71e1217beed9c1781
SHA1 2427804b70e478c663a55e5aa4d9541e20120b50
SHA512 9d51e3a4243fae6c354e8b81a4acbb9f2966ea8f6c7419dd79b486391af3d5873768889f9e6850d6f0b4ca844b5ceefee508d2366d6bfd2d0390286043163227
SSDEEP 3072:G4c+aFQGAOGWcroDwXrJsCkK3hYIQtHu1tW:GV+aFWOGWioDspzLmu1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e5af3b8208bb4097cb986c3ee1d6152698a52ebf124f25de964927d24516669c

File Explorer

e5af3b8208bb4097cb986c3ee1d6152698a52ebf124f25de964927d24516669c

.dll 176KB

e5af3b8208bb4097cb986c3ee1d6152698a52ebf124f25de964927d24516669c

IMPHASH 436379e4c0169de082f04d9af23bbe38
SHA256 e5af3b8208bb4097cb986c3ee1d6152698a52ebf124f25de964927d24516669c
MD5 d8fb66eba757ede71e1217beed9c1781
SHA1 2427804b70e478c663a55e5aa4d9541e20120b50
SHA512 9d51e3a4243fae6c354e8b81a4acbb9f2966ea8f6c7419dd79b486391af3d5873768889f9e6850d6f0b4ca844b5ceefee508d2366d6bfd2d0390286043163227
SSDEEP 3072:G4c+aFQGAOGWcroDwXrJsCkK3hYIQtHu1tW:GV+aFWOGWioDspzLmu1
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Detect Blackmoon payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

58338

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LCMapStringA GetCommandLineA DeleteFileA FindClose FindFirstFileA FindNextFileA GetModuleFileNameA IsBadReadPtr HeapFree HeapReAlloc HeapAlloc ExitProcess GetModuleHandleA GetProcessHeap AddVectoredExceptionHandler Process32Next CloseHandle Process32First SetStdHandle IsBadCodePtr GetStringTypeW GetStringTypeA SetUnhandledExceptionFilter CreateToolhelp32Snapshot Sleep VirtualFreeEx VirtualAllocEx LocalSize GetProcAddress FreeLibrary CreateThread VirtualProtect LCMapStringW IsBadWritePtr RtlMoveMemory LoadLibraryA VirtualAlloc VirtualFree HeapCreate GetCurrentThreadId GetCurrentThread lstrcmpiA lstrcmpA GlobalDeleteAtom GlobalAlloc GlobalLock LocalAlloc LocalFree InitializeCriticalSection TlsAlloc DeleteCriticalSection GlobalFree GlobalUnlock GlobalHandle TlsFree LeaveCriticalSection GlobalReAlloc EnterCriticalSection TlsSetValue LocalReAlloc TlsGetValue InterlockedDecrement SetErrorMode lstrcatA lstrcpyA lstrcpynA lstrlenA GetVersion GlobalFlags WritePrivateProfileStringA InterlockedIncrement WideCharToMultiByte MultiByteToWideChar SetLastError GetLastError GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA GetProcessVersion GetCurrentProcess WriteFile SetFilePointer FlushFileBuffers GetCPInfo GetOEMCP RtlUnwind TerminateProcess RaiseException HeapSize GetACP SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW GetEnvironmentVariableA GetVersionExA HeapDestroy

psapi

GetModuleBaseNameA

user32

LoadStringA GetSysColorBrush LoadCursorA LoadIconA GetSysColor PeekMessageA GetMessageA TranslateMessage DispatchMessageA wsprintfA MessageBoxA GetWindowThreadProcessId MapWindowPoints GrayStringA PostQuitMessage PostMessageA SendMessageA SetCursor EnableWindow GetWindowLongA IsWindowEnabled GetLastActivePopup GetParent SetWindowsHookExA GetCursorPos IsWindowVisible ValidateRect CallNextHookEx GetKeyState GetActiveWindow GetNextDlgTabItem GetFocus EnableMenuItem CheckMenuItem SetMenuItemBitmaps ModifyMenuA GetMenuState LoadBitmapA GetMenuCheckMarkDimensions UnhookWindowsHookEx UnregisterClassA GetClassNameA PtInRect GetWindowRect GetDlgCtrlID GetWindow ClientToScreen SetWindowTextA GetWindowTextA GetMenuItemCount GetDC ReleaseDC TabbedTextOutA DrawTextA DestroyMenu GetDlgItem SetWindowLongA SetWindowPos ShowWindow SetFocus GetSystemMetrics GetWindowPlacement IsIconic SystemParametersInfoA RegisterWindowMessageA SetForegroundWindow GetForegroundWindow GetMessagePos GetMessageTime DefWindowProcA RemovePropA CallWindowProcA GetPropA SetPropA GetClassLongA CreateWindowExA DestroyWindow GetMenuItemID GetSubMenu GetMenu RegisterClassA GetClassInfoA WinHelpA GetCapture GetTopWindow CopyRect GetClientRect AdjustWindowRectEx

gdi32

Escape ExtTextOutA TextOutA RectVisible PtVisible GetDeviceCaps GetObjectA GetStockObject CreateBitmap DeleteObject DeleteDC SaveDC RestoreDC SelectObject SetBkColor SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx GetClipBox

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegCreateKeyExA RegCloseKey RegSetValueExA RegOpenKeyExA

comctl32

ord17