blackmoon | e9a307aae0581b5f042c6c0a1cb29dc697f034ac5b08b7491ca115f6d44ba58a

Sharing

Copy URL Twitter E-mail

General

Target

e9a307aae0581b5f042c6c0a1cb29dc697f034ac5b08b7491ca115f6d44ba58a
Size

972KB
MD5

f2e79ed4189c45966d4f6f1da3c3510c
SHA1

eba5b4452f57e99322738bb7a3080545848002f7
SHA256

e9a307aae0581b5f042c6c0a1cb29dc697f034ac5b08b7491ca115f6d44ba58a
SHA512

953d7d5a776afd348affd2a57ebb4d3eac58bce279cc459fe663dfcb677c4a5df1c1bd230c8934f5969748c3602895852cabe83b173a2eeb58147344be5142e7
SSDEEP

24576:DemP8TjRLG2jmiuVzsRstmisXwcez13Q1BPI4Q1B9QIoZam40cs8FwaObMv24u34:yWoUzsRstmisXwcez13Q1BPI4Q1B9QI5

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e9a307aae0581b5f042c6c0a1cb29dc697f034ac5b08b7491ca115f6d44ba58a

Files

e9a307aae0581b5f042c6c0a1cb29dc697f034ac5b08b7491ca115f6d44ba58a
.dll windows:4 windows x86 arch:x86

518b3ab2efbda5823b11080d31816cd4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
lstrcmpW
GetModuleHandleW
GetCommandLineW
GetModuleFileNameW
lstrcatA
ExitProcess
HeapReAlloc
IsBadReadPtr
CreateProcessA
GetStartupInfoA
GetTickCount
SetFilePointer
GetFileSize
GetLocalTime
SetFileAttributesA
FindNextFileA
FindFirstFileA
GetUserDefaultLCID
MulDiv
GetDiskFreeSpaceA
GetCurrentDirectoryA
GetPrivateProfileStringA
WritePrivateProfileStringA
DeleteFileA
RemoveDirectoryA
MoveFileA
CreateDirectoryA
CopyFileA
GetEnvironmentVariableA
GetModuleFileNameA
GetCommandLineA
LCMapStringA
ProcessIdToSessionId
HeapDestroy
HeapCreate
GetAtomNameW
FreeLibrary
SetEvent
WaitForSingleObject
WriteProcessMemory
ReadProcessMemory
VirtualProtectEx
lstrcatW
lstrcmpiW
lstrcmpA
GetVersion
TerminateThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetSystemPowerState
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
MultiByteToWideChar
lstrlenW
WideCharToMultiByte
GetCurrentProcess
VirtualQueryEx
CloseHandle
lstrcpynA
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
IsBadStringPtrA
OpenProcess
TerminateProcess
CreateWaitableTimerA
SetWaitableTimer
lstrcpyn
RtlMoveMemory
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalSize
GlobalFree
SetProcessWorkingSetSize
Process32First
Process32Next
LocalAlloc
LocalFree
Module32First
Module32Next
GetDateFormatA
GetCurrentProcessId
GetTimeFormatA
WTSGetActiveConsoleSessionId
GetLocaleInfoA
_lopen
GetFileSizeEx
_lclose
CreateFileW
GetFileTime
lstrlenA
InterlockedDecrement
InterlockedIncrement
LocalSize
FileTimeToLocalFileTime
FileTimeToSystemTime
VirtualAlloc
CreateEventA
GetCurrentThreadId
FindClose
FindFirstFileW
WriteFile
RtlZeroMemory
GetFileAttributesW
GetLogicalDriveStringsA
GetDriveTypeA
GetExitCodeProcess
ReadFile
PeekNamedPipe
CreateProcessW
CreatePipe
GetLastError
GetQueuedCompletionStatus
CreateThread
CreateIoCompletionPort
GlobalMemoryStatusEx
HeapFree
HeapAlloc
GetProcessHeap
CreateFileA
IsWow64Process
GetSystemInfo
GetVersionExA
GetModuleHandleA
GetProcAddress
LoadLibraryA
VirtualFree

user32

SetRect
SetWindowRgn
LoadIconW
EnumPropsExW
RemovePropA
RemovePropW
GetPropA
GetPropW
SetPropA
SetPropW
KillTimer
SetTimer
MessageBoxW
SetWindowTextW
IsIconic
IsZoomed
GetMenu
SetMenu
DrawMenuBar
RegisterWindowMessageW
SystemParametersInfoW
GetMessageW
FindWindowExA
GetWindowTextLengthW
GetWindowTextW
OpenInputDesktop
MsgWaitForMultipleObjects
SetWindowsHookExA
CallNextHookEx
PostMessageW
keybd_event
LockWorkStation
BlockInput
mouse_event
TranslateAcceleratorW
DispatchMessageW
IsChild
TranslateMDISysAccel
IsDialogMessageW
PostQuitMessage
FillRect
DrawFocusRect
OffsetRect
CopyRect
FrameRect
InflateRect
GetSysColorBrush
GetWindowDC
DefWindowProcA
EnumChildWindows
SendMessageA
RedrawWindow
GetWindowTextLengthA
EnumThreadWindows
DrawTextA
SetParent
UpdateWindow
ValidateRect
InvalidateRect
ScreenToClient
GetFocus
CopyIcon
DefWindowProcW
CreateMDIWindowW
CreateIconFromResourceEx
CreateDialogParamW
EndDialog
DialogBoxIndirectParamW
DestroyWindow
SetClassLongW
GetClassLongW
CreateDialogIndirectParamW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
CloseDesktop
SetThreadDesktop
GetThreadDesktop
DrawIcon
GetCursorInfo
GetDesktopWindow
GetIconInfo
CallWindowProcW
SetFocus
ExitWindowsEx
ClientToScreen
SetCursorPos
ShowWindow
FindWindowA
GetWindowRect
GetDC
CopyImage
ReleaseDC
GetNextDlgTabItem
ShowWindowAsync
CloseWindow
GetSystemMetrics
PostMessageA
SetForegroundWindow
MoveWindow
EnumWindows
IsWindowVisible
GetWindowTextA
GetClassNameA
GetWindowThreadProcessId
SetWindowLongA
GetWindowLongA
SetLayeredWindowAttributes
GetMessageA
TranslateMessage
DispatchMessageA
WaitForInputIdle
CallWindowProcA
OpenWindowStationA
SetProcessWindowStation
BeginPaint
EndPaint
TrackMouseEvent
GetDlgItem
GetAncestor
SetWindowLongW
GetAsyncKeyState
IsWindow
FindWindowExW
GetClassNameW
GetParent
GetWindowLongW
SendMessageW
DestroyCursor
SetCursor
GetClientRect
SetCapture
ReleaseCapture
LoadCursorW
DestroyIcon
DestroyAcceleratorTable
GetSysColor
IsWindowEnabled
EnableWindow
SetWindowPos
LoadImageW
DrawIconEx
GetInputState
UpdateLayeredWindow
CreateMenu
CreatePopupMenu
GetSystemMenu
LoadMenuW
GetMenuInfo
DestroyMenu
GetMenuItemCount
AppendMenuW
GetMenuItemInfoW
InsertMenuW
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
PeekMessageA
wsprintfA
MessageBoxA
CharLowerW
CharUpperW
LoadStringW
SetMenuDefaultItem
SetMenuItemInfoW
CheckMenuItem
RemoveMenu
MenuItemFromPoint
GetMenuDefaultItem
GetMenuState
GetMenuItemRect
GetMenuStringW
DialogBoxParamW
TrackPopupMenu
UnhookWindowsHookEx

advapi32

RevertToSelf
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
ImpersonateLoggedOnUser
StartServiceCtrlDispatcherA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegisterServiceCtrlHandlerA
SetServiceStatus
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegCreateKeyA
DuplicateTokenEx
SetTokenInformation
CreateProcessAsUserA
LookupAccountSidA
RegOpenKeyA
RegEnumKeyA
RegEnumValueA
RegOpenCurrentUser
RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
RegQueryInfoKeyA
RegFlushKey
OpenServiceA
QueryServiceStatus
QueryServiceConfigA
QueryServiceConfig2A
ChangeServiceConfig2A
GetServiceDisplayNameA
GetServiceKeyNameA
DeleteService
StartServiceA
ControlService
ChangeServiceConfigA
EnumServicesStatusA
EnumServicesStatusExA
EnumDependentServicesA

shell32

Shell_NotifyIconW
DragQueryFileW
CommandLineToArgvW
SHGetFolderPathA
DragAcceptFiles
DragFinish
SHGetSpecialFolderPathA
ShellExecuteA

ole32

CLSIDFromProgID
CoCreateInstance
OleRun
StringFromGUID2
CoUninitialize
CLSIDFromString
GetHGlobalFromStream
CreateStreamOnHGlobal
CoInitialize

winmm

waveInClose
waveInStop
waveInUnprepareHeader
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveInOpen
waveInGetNumDevs
waveInGetDevCapsA

ws2_32

getsockname
recvfrom
htonl
ntohs
getpeername
send
recv
select
__WSAFDIsSet
accept
socket
bind
listen
WSAStartup
closesocket
WSARecv
WSASend
WSASocketA
inet_addr
htons
connect
gethostbyname
WSACleanup
inet_ntoa
gethostname
sendto

gdi32

GetDIBits
SetTextColor
SetBkMode
SetBkColor
GetTextMetricsA
GetDeviceCaps
CreateDIBSection
GdiFlush
DeleteDC
GetObjectA
CreateSolidBrush
GetObjectW
GetStretchBltMode
SetStretchBltMode
StretchBlt
CreateFontIndirectW
CreatePatternBrush
BitBlt
SelectObject
GetStockObject
DeleteObject
CreateCompatibleBitmap
CreateRoundRectRgn
GetTextExtentPoint32A
GetTextColor
SetPixel
CreatePen
LineTo
MoveToEx
SelectClipRgn
CreateEllipticRgnIndirect
Arc
Ellipse
GetPixel
CreateCompatibleDC

comctl32

InitCommonControlsEx
_TrackMouseEvent

msimg32

AlphaBlend
GradientFill

gdiplus

GdipWindingModeOutline
GdipWarpPath
GdipIsVisiblePathPoint
GdipIsOutlineVisiblePathPoint
GdipCreateRegionRect
GdipCreateRegionPath
GdipCreateRegionHrgn
GdipCreateRegionRgnData
GdipCloneRegion
GdipSetInfinite
GdipSetEmpty
GdipCombineRegionRect
GdipCombineRegionRegion
GdipCombineRegionPath
GdipTranslateRegion
GdipTransformRegion
GdipGetRegionBounds
GdipGetRegionDataSize
GdipGetRegionData
GdipGetRegionHRgn
GdipIsEmptyRegion
GdipIsInfiniteRegion
GdipIsEqualRegion
GdipIsVisibleRegionPoint
GdipIsVisibleRegionRect
GdipGetRegionScansCount
GdipGetRegionScans
GdipCreateBitmapFromFile
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromHICON
GdipCreateBitmapFromResource
GdipCloneBitmapArea
GdipBitmapSetResolution
GdipCreateSolidFill
GdipCreateMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipCreateMatrix2
GdipCreateMatrix3
GdipCloneMatrix
GdipSetMatrixElements
GdipGetMatrixElements
GdipMultiplyMatrix
GdipInvertMatrix
GdipScaleMatrix
GdipShearMatrix
GdipTransformMatrixPoints
GdipVectorTransformMatrixPoints
GdipIsMatrixInvertible
GdipIsMatrixIdentity
GdipIsMatrixEqual
GdipNewInstalledFontCollection
GdipNewPrivateFontCollection
GdipPrivateAddFontFile
GdipPrivateAddMemoryFont
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilyMonospace
GdipGetFamilyName
GdipIsStyleAvailable
GdipGetEmHeight
GdipGetCellAscent
GdipGetCellDescent
GdipGetLineSpacing
GdipGetClipBounds
GdipGetClip
GdipTranslateClip
GdipWidenPath
GdipSetClipHrgn
GdipSetClipRegion
GdipSetClipRect
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRect
GdipDrawImagePointRect
GdipDrawImagePoints
GdipDrawImageRect
GdipDrawImageRectRect
GdipCreatePath
GdipDrawDriverString
GdipMeasureCharacterRanges
GdipCreateRegion
GdipMeasureString
GdipDrawString
GdipFillRegion
GdipFillClosedCurve2
GdipFillClosedCurve
GdipFillPath
GdipFillPie
GdipFillEllipse
GdipFillPolygon
GdipGraphicsClear
GdipFlattenPath
GdipGetPathWorldBounds
GdipDrawClosedCurve2
GdipDrawClosedCurve
GdipDrawCurve2
GdipDrawCurve
GdipDrawPath
GdipAddPathString
GdipDrawPie
GdipDrawEllipse
GdipDrawRectangle
GdipDrawBezier
GdipGetFontHeightGivenDPI
GdipGetFontHeight
GdipGetVisibleClipBounds
GdipGetFontSize
GdipGetFontStyle
GdipGetFamily
GdipGetLogFontA
GdipGetLogFontW
GdipCloneFont
GdipCreateFontFromLogfontA
GdipDrawArc
GdipDrawLine
GdipGetNearestColor
GdipCreateFontFromDC
GdipDeleteFontFamily
GdipDeletePrivateFontCollection
GdipCreateFontFromLogfontW
GdipCreateFont
GdipGetImageGraphicsContext
GdipCreateFromHWND
GdipCreateHICONFromBitmap
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageThumbnail
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageBounds
GdipGetImageDimension
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipCloneImage
GdipTransformPointsI
GdipTransformPoints
GdipGetDpiY
GdipGetDpiX
GdipResetClip
GdipTransformPath
GdipGetPageScale
GdipSetPageScale
GdipGetPageUnit
GdipSetPageUnit
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipDeleteMatrix
GdipGetWorldTransform
GdipSetWorldTransform
GdipGetPixelOffsetMode
GdipSetPixelOffsetMode
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipGetInterpolationMode
GdipSetInterpolationMode
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipReleaseDC
GdipGetDC
GdipFlush
GdipCreateFromHDC
GdipSetImageAttributesColorMatrix
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesWrapMode
GdipSetImageAttributesRemapTable
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesColorKeys
GdipSetImageAttributesGamma
GdipSetImageAttributesNoOp
GdipSetImageAttributesThreshold
GdipResetImageAttributes
GdipSetImageAttributesToIdentity
GdipCloneImageAttributes
GdipCreateImageAttributes
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipDeleteRegion
GdipDeletePath
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipDeleteBrush
GdipFillRectangle
GdipCreateTexture
GdiplusShutdown
GdipDisposeImage
GdipSaveImageToStream
GdipCreateBitmapFromHBITMAP
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream
GdiplusStartup
GdipAddPathPath
GdipAddPathPolygon
GdipAddPathPie
GdipAddPathEllipse
GdipAddPathRectangle
GdipAddPathClosedCurve2
GdipAddPathClosedCurve
GdipAddPathCurve2
GdipAddPathCurve
GdipAddPathBezier
GdipAddPathArc
GdipAddPathLine
GdipGetPathLastPoint
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipEndContainer
GdipBeginContainer2
GdipBeginContainer
GdipRestoreGraphics
GdipSaveGraphics
GdipIsVisibleRect
GdipIsVisiblePoint
GdipIsVisibleClipEmpty
GdipReversePath
GdipClearPathMarkers
GdipSetPathMarker
GdipClosePathFigures
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathData
GdipGetPointCount
GdipSetPathFillMode
GdipGetPathFillMode
GdipResetPath
GdipClonePath
GdipDrawPolygon
GdipCreatePath2
GdipDrawImage
GdipIsClipEmpty
GdipGetFontUnit
GdipDeleteFont

oleaut32

VariantTimeToSystemTime
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
VariantCopy
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
VariantChangeType
VarR8FromBool
VarR8FromCy
SysFreeString
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantInit
SystemTimeToVariantTime

wtsapi32

WTSQueryUserToken

shlwapi

StrTrimW
PathFileExistsA
StrToIntExW
wvnsprintfW
PathIsDirectoryA
PathFindFileNameW
PathRemoveFileSpecW
StrToIntW
StrFormatByteSize64A

wininet

HttpQueryInfoA
InternetReadFile
HttpSendRequestA
InternetSetOptionA
HttpOpenRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
InternetGetConnectedState

psapi

EnumProcessModules
GetModuleFileNameExA

userenv

CreateEnvironmentBlock

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

winhttp

WinHttpCrackUrl
WinHttpOpen
WinHttpSetTimeouts
WinHttpConnect
WinHttpCheckPlatform
WinHttpQueryHeaders
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpSetOption
WinHttpCloseHandle
WinHttpSetCredentials
WinHttpOpenRequest

crypt32

CryptStringToBinaryW

atl

ord42

dbghelp

MakeSureDirectoryPathExists

msvcrt

sprintf
??3@YAXPAX@Z
strrchr
??2@YAPAXI@Z
_ftol
atoi
free
malloc
_atoi64
atof
strchr
__CxxFrameHandler
strncpy
modf
floor
_CIfmod
_CIpow
strncmp
_stricmp
rand
realloc
memmove
_except_handler3
calloc
__dllonexit
_onexit
srand
strtod

Exports

Exports

ServiceMain
init

Sections

.text
Size: 820KB - Virtual size: 818KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

518b3ab2efbda5823b11080d31816cd4

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

winmm

ws2_32

gdi32

comctl32

msimg32

gdiplus

oleaut32

wtsapi32

shlwapi

wininet

psapi

userenv

version

winhttp

crypt32

atl

dbghelp

msvcrt

Exports

Exports

Sections

.text Size: 820KB - Virtual size: 818KB

.rdata Size: 28KB - Virtual size: 24KB

.data Size: 84KB - Virtual size: 166KB

.CRT Size: 4KB - Virtual size: 4B

.rsrc Size: 4KB - Virtual size: 756B

.reloc Size: 28KB - Virtual size: 27KB

.text
Size: 820KB - Virtual size: 818KB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 84KB - Virtual size: 166KB

.CRT
Size: 4KB - Virtual size: 4B

.rsrc
Size: 4KB - Virtual size: 756B

.reloc
Size: 28KB - Virtual size: 27KB