blackmoon | 92f52e5d61b26c3acf467fc598d01493f15b9c476048402957ad482b84b9a551

Sharing

Copy URL

Twitter E-mail

General

Target

92f52e5d61b26c3acf467fc598d01493f15b9c476048402957ad482b84b9a551
Size

1.4MB
MD5

da21bc3ef41efe46bdc6254c38156862
SHA1

e8f3fcdafe661f70766ed3273db885f892e2f01c
SHA256

92f52e5d61b26c3acf467fc598d01493f15b9c476048402957ad482b84b9a551
SHA512

b5ff6cb001fd338b84c77f0c965668a2bd2aad32e5beb8a12325b92771709e1723fd6290c2c245f27a5a782a7ee0f70084d78c52a5ba803b0f45759fd6b1e30b
SSDEEP

24576:FS5HQAfDjjS1TkeVtoKeeF+5ZPQpJhpA8q6Ew/VULyVDFFW0:F15F+5xQpJ9F

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
92f52e5d61b26c3acf467fc598d01493f15b9c476048402957ad482b84b9a551

Files

92f52e5d61b26c3acf467fc598d01493f15b9c476048402957ad482b84b9a551
.exe windows:4 windows x86 arch:x86

af55ee532be7c451898698bdeb7afefa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObject
CreateIoCompletionPort
GetQueuedCompletionStatus
GetComputerNameA
GetVersionExA
GetSystemInfo
Module32First
GetTempPathW
lstrcpyn
GetExitCodeThread
TerminateThread
GetCurrentThreadId
CreatePipe
CreateProcessA
PeekNamedPipe
ReadFile
GetExitCodeProcess
GetProcAddress
CreateProcessW
IsWow64Process
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
VirtualFreeEx
GetProcessHeap
HeapAlloc
HeapFree
VirtualAlloc
LoadLibraryA
VirtualFree
MoveFileA
DeleteFileW
FindNextFileW
ExitProcess
HeapReAlloc
IsBadReadPtr
SetFileAttributesA
GetModuleFileNameA
WriteFile
CreateFileA
CreateDirectoryA
GetFileAttributesA
GetStartupInfoA
GetFileSize
GetEnvironmentVariableA
GetLocalTime
GlobalUnlock
GlobalLock
GlobalAlloc
GetUserDefaultLCID
FindNextFileA
FindFirstFileA
GetTempPathA
SetFilePointer
RemoveDirectoryA
CreateThread
Process32First
SetCurrentDirectoryA
GetCommandLineA
FreeLibrary
LCMapStringA
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
RaiseException
IsBadWritePtr
HeapCreate
HeapDestroy
TlsGetValue
TlsAlloc
TlsSetValue
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
InterlockedIncrement
InterlockedDecrement
RtlUnwind
GetVersion
GetLastError
SetSystemPowerState
DeleteCriticalSection
GetTickCount
lstrcpynA
LocalSize
FindClose
FindFirstFileW
CreateDirectoryW
DeleteFileA
lstrlenW
FileTimeToSystemTime
Process32Next
QueryDosDeviceW
TerminateProcess
Process32NextW
Sleep
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcessId
MultiByteToWideChar
GetModuleHandleA
WideCharToMultiByte
RtlMoveMemory
SetWaitableTimer
CreateWaitableTimerA
CloseHandle
LocalFree
LocalAlloc
OpenProcess
SetLastError
GetNativeSystemInfo
GetCurrentProcess
FileTimeToLocalFileTime

user32

TranslateMessage
EmptyClipboard
DispatchMessageA
GetClipboardData
MessageBoxA
wsprintfA
GetMessageA
CloseClipboard
OpenClipboard
ExitWindowsEx
MsgWaitForMultipleObjects
FindWindowExA
GetWindowTextLengthW
GetWindowTextW
PostMessageW
GetParent
GetClassNameA
GetWindowTextA
SendMessageA
GetWindowLongA
SetWindowLongA
SetLayeredWindowAttributes
EnumChildWindows
GetFocus
ClientToScreen
GetWindowInfo
EnumWindows
GetWindowThreadProcessId
GetWindowRect
MoveWindow
GetDesktopWindow
PostMessageA
PeekMessageA
WaitForInputIdle
CallWindowProcA
KillTimer
SetTimer
MapVirtualKeyA
SendInput
SetActiveWindow
AttachThreadInput
GetAncestor
GetCursorPos
WindowFromPoint
SetCursorPos
DrawIcon
GetIconInfo
GetCursorInfo
ReleaseDC
GetForegroundWindow
GetWindowTextLengthA
GetSystemMetrics
IsWindowVisible
GetMenuItemID
GetSubMenu
GetMenu
GetClientRect
PostThreadMessageA
IsWindow
SetClipboardData

advapi32

RegEnumKeyExA
RegCreateKeyExA
RegFlushKey
RegQueryInfoKeyA
RegEnumKeyA
RegDeleteValueA
RegOpenKeyA
RegDeleteKeyA
RegCreateKeyA
RegSetValueExA
RegQueryValueExA
RegEnumValueA
RegCloseKey
RegOpenKeyExA
GetUserNameA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

shell32

SHChangeNotify
ShellExecuteA
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoInitialize

wininet

HttpSendRequestA
InternetSetOptionA
HttpOpenRequestA
HttpQueryInfoA
InternetOpenA
InternetConnectA
InternetCloseHandle
InternetReadFile

ws2_32

send
closesocket
recv
WSAStartup
socket
inet_addr
htons
connect
setsockopt
WSACleanup
gethostbyname

psapi

GetProcessImageFileNameW
GetModuleFileNameExA

shlwapi

PathFindExtensionA
PathIsDirectoryW
PathFileExistsA
PathFindFileNameA

crypt32

CryptStringToBinaryA

gdi32

CreateCompatibleDC
DeleteDC
SelectObject
DeleteObject
BitBlt
GdiFlush
CreateDIBSection

oleacc

AccessibleObjectFromPoint
AccessibleChildren
GetRoleTextA
GetStateTextA
WindowFromAccessibleObject
AccessibleObjectFromWindow

oleaut32

SafeArrayDestroy
VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
SysFreeString
VarR8FromCy
VarR8FromBool
VariantChangeType
VariantCopy
SafeArrayCreate
SysAllocString
SafeArrayGetElemsize

Sections

.text
Size: 396KB - Virtual size: 392KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1004KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

af55ee532be7c451898698bdeb7afefa

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

wininet

ws2_32

psapi

shlwapi

crypt32

gdi32

oleacc

oleaut32

Sections

.text Size: 396KB - Virtual size: 392KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 1004KB - Virtual size: 1.1MB

.rsrc Size: 24KB - Virtual size: 20KB

.text
Size: 396KB - Virtual size: 392KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 1004KB - Virtual size: 1.1MB

.rsrc
Size: 24KB - Virtual size: 20KB