blackmoon | 6e33de647f9c17d8e8f962807096e3c3[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

6e33de647f9c17d8e8f962807096e3c3.bin
Size

138KB
MD5

2fbe2182f70ff0a26ddd15bde8653ef6
SHA1

28ab35486a826224cd80a4090641987b7ddeddef
SHA256

f781fb72b5f5fbb254e47b9da222f75e71344d9ce495f8058eb99262fe9916a2
SHA512

e7fefbb006d5e1b7bd3523686e533145327adbcc969924a31c14b43f2799331bb6ad2687c8a6999dd0735202a211056ba19c5baeb40be49c0876ac07dbfbce80
SSDEEP

3072:knKHWn/fQJwoI/6Nr8xGwGRPS/LcbrVSo7B7WYA059Q6kSqYwe5/l6NFq:kKHQfX/IwIg4fb7bTz2SqmLcFq

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
static1/unpack001/6ccb6da37f72c97347ea9314b01b388a7998e6d00be3e0fecfb9f8f26a4a7da8.exe	family_blackmoon

Files

6e33de647f9c17d8e8f962807096e3c3.bin
.zip

Password: infected
6ccb6da37f72c97347ea9314b01b388a7998e6d00be3e0fecfb9f8f26a4a7da8.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f11dd842ac7734df3e2cce636d9237a3

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:06:86:2c:00:00:00:00:00:02
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2011-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)2011,O=VeriSign Inc.,C=US

Not Before

17/11/2011, 05:06

Not After

17/11/2511, 05:01

Subject

CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageKeyEncipherment
KeyUsageDataEncipherment

31:f7:a3:e8:eb:66:55:9c:ab:1e:ff:90:fc:33:05:be:b8:22:cf:01
Signer

Actual PE Digest

31:f7:a3:e8:eb:66:55:9c:ab:1e:ff:90:fc:33:05:be:b8:22:cf:01

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
Sleep
GetTickCount
GetCommandLineA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
ExitProcess
RtlMoveMemory
GetModuleHandleA
LCMapStringA
GetProcessHeap
RtlZeroMemory
LocalSize
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStartupInfoA
GetVersion
RtlUnwind
InterlockedDecrement
InterlockedIncrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
RaiseException
VirtualAlloc
IsBadWritePtr
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
CloseHandle
SetFilePointer
MultiByteToWideChar
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
GetStringTypeA

user32

PeekMessageA
MessageBoxA
wsprintfA
DispatchMessageA
GetMessageA
TranslateMessage

shell32

CommandLineToArgvW
ShellExecuteA

iphlpapi

GetIpForwardTable

advapi32

AdjustTokenPrivileges
CreateProcessAsUserA

ws2_32

WSAStartup

Sections

.text
Size: 144KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 580KB - Virtual size: 577KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

f11dd842ac7734df3e2cce636d9237a3

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

61:06:86:2c:00:00:00:00:00:02Certificate

Extended Key Usages

Key Usages

31:f7:a3:e8:eb:66:55:9c:ab:1e:ff:90:fc:33:05:be:b8:22:cf:01Signer

Headers

File Characteristics

Imports

kernel32

user32

shell32

iphlpapi

advapi32

ws2_32

Sections

.text Size: 144KB - Virtual size: 142KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 64KB - Virtual size: 129KB

.rsrc Size: 580KB - Virtual size: 577KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

61:06:86:2c:00:00:00:00:00:02
Certificate

31:f7:a3:e8:eb:66:55:9c:ab:1e:ff:90:fc:33:05:be:b8:22:cf:01
Signer

.text
Size: 144KB - Virtual size: 142KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 64KB - Virtual size: 129KB

.rsrc
Size: 580KB - Virtual size: 577KB