blackmoon | 8809b3624ac406843fe235f4a54c2ebc07dfa5d673996419c5fb778fe16ed06d

Sharing

Copy URL Twitter E-mail

General

Target

8809b3624ac406843fe235f4a54c2ebc07dfa5d673996419c5fb778fe16ed06d
Size

1.4MB
MD5

3bb194b080dbb2b9c2fcf72a42e67079
SHA1

086e16e581ed26199f0812a8f5536864ce06821e
SHA256

8809b3624ac406843fe235f4a54c2ebc07dfa5d673996419c5fb778fe16ed06d
SHA512

0752f0a24edaef9fc9e22a65a38be7f0084f2ca4b42d627a74b3ecb365c06b193c5f1a045ad79e78fb8932f72cd602f5773e9c1c7f62531850638962fdef5864
SSDEEP

24576:fsVeqZOhL6v1kHFaN5sKjkaTIM6KR7s07ZuaqW3:flwqCYMuv

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8809b3624ac406843fe235f4a54c2ebc07dfa5d673996419c5fb778fe16ed06d

Files

8809b3624ac406843fe235f4a54c2ebc07dfa5d673996419c5fb778fe16ed06d
.dll windows:4 windows x86 arch:x86

271b481450f3d89da9fa7db61ebbd6b5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThreadId
WideCharToMultiByte
VirtualQueryEx
VirtualProtectEx
GetCurrentProcessId
OpenProcess
TerminateProcess
RtlZeroMemory
IsDebuggerPresent
OpenEventA
GlobalAlloc
RtlMoveMemory
GlobalFree
CreateToolhelp32Snapshot
Thread32First
Thread32Next
lstrcpyn
CreateEventA
HeapCreate
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
VirtualProtect
CreateThread
InterlockedIncrement
InterlockedDecrement
HeapFree
VirtualAlloc
HeapAlloc
GetProcessHeap
lstrlenW
HeapDestroy
MulDiv
InterlockedExchange
SetEnvironmentVariableA
CompareStringW
CompareStringA
LCMapStringA
GetCommandLineA
SetEndOfFile
GetLocalTime
SetFilePointer
GetFileSize
ReadFile
WriteFile
Sleep
GetStartupInfoA
CreateProcessA
WaitForSingleObject
CreateDirectoryA
FindFirstFileA
RemoveDirectoryA
DeleteFileA
FindNextFileA
FindClose
GetPrivateProfileStringA
IsBadReadPtr
HeapReAlloc
ExitProcess
CreateFileA
DeviceIoControl
Process32Next
lstrcmpiA
LoadLibraryA
GetSystemDirectoryA
FreeLibrary
GetTickCount
CloseHandle
lstrcmpA
LocalFree
lstrlenA
GetTempPathA
GetWindowsDirectoryA
GetVersionExA
GetLastError
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateThread
Process32First
GlobalUnlock
GlobalLock
lstrcpyA
SetLastError
lstrcatA
GetTimeZoneInformation
GetVersion
MultiByteToWideChar
GetCurrentThread
GlobalDeleteAtom
FlushFileBuffers
lstrcpynA
LocalAlloc
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
SetErrorMode
GlobalFlags
WritePrivateProfileStringA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
GetCPInfo
GetOEMCP
RtlUnwind
GetSystemTime
RaiseException
GetACP
HeapSize
SetStdHandle
GetFileType
SetHandleCount
GetStdHandle
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
VirtualFree
IsBadWritePtr
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr

user32

UnhookWindowsHookEx
UnregisterClassA
GetDlgCtrlID
GetMenuItemCount
SetWindowPos
SetFocus
GetWindowPlacement
IsIconic
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
MapWindowPoints
LoadStringA
DestroyMenu
SetWindowsHookExA
GetLastActivePopup
SetCursor
GetWindow
PtInRect
IsWindowVisible
GetWindowLongA
GrayStringA
GetCursorPos
SetWindowLongA
GetDlgItem
DrawTextA
TabbedTextOutA
ClientToScreen
GetMenuCheckMarkDimensions
LoadBitmapA
PostMessageA
MessageBoxA
FindWindowExA
GetWindowThreadProcessId
SetTimer
KillTimer
LoadIconA
LoadCursorA
RegisterClassW
GetDC
ReleaseDC
DefWindowProcW
SetWindowLongW
ShowWindow
DestroyWindow
SendMessageW
GetWindowRect
GetParent
ScreenToClient
GetWindowLongW
MoveWindow
GetSysColor
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
FindWindowA
GetClassNameA
GetSysColorBrush
GetWindowTextLengthW
GetClientRect
DrawTextW
PrintWindow
TrackMouseEvent
AdjustWindowRectEx
SystemParametersInfoA
CreateWindowExW
IsWindowEnabled
EnableWindow
SetLayeredWindowAttributes
InvalidateRect
SetWindowTextA
SendMessageA
GetWindowTextLengthA
GetWindowTextA
GetMessageW
GetAncestor
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
PostQuitMessage
IsWindow
wsprintfA
DispatchMessageA
GetMessageA
PeekMessageA
CheckMenuItem
EnableMenuItem
GetSystemMetrics
SetForegroundWindow
GetActiveWindow
GetForegroundWindow
GetFocus
GetNextDlgTabItem
GetKeyState
CallNextHookEx
ValidateRect

advapi32

RegDeleteValueA
RegDeleteKeyA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
DeleteService
ControlService
StartServiceA
CloseServiceHandle
OpenServiceA
CreateServiceA
OpenSCManagerA
CryptDecrypt
CryptGetKeyParam
CryptDestroyKey
CryptSetKeyParam
CryptEncrypt
CryptImportKey
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptReleaseContext
CryptAcquireContextA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA

shell32

DragQueryFileW
DragFinish
SHGetSpecialFolderPathA

ole32

CLSIDFromString

shlwapi

wvnsprintfA
StrDupW
PathFileExistsA

gdi32

GetClipBox
CreateSolidBrush
StretchBlt
SetStretchBltMode
GetObjectA
CreateCompatibleBitmap
DeleteDC
DeleteObject
BitBlt
CreateDIBSection
CreateCompatibleDC
SelectObject
SetBkMode
SetBkColor
SetTextColor
GetDeviceCaps
GetStockObject
ScaleWindowExtEx
SetWindowExtEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
RestoreDC
SaveDC
CreateBitmap

comctl32

InitCommonControlsEx
ord17

wininet

InternetGetCookieA
InternetSetCookieA
InternetCanonicalizeUrlA
InternetCrackUrlA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile
InternetConnectA
InternetSetOptionA
InternetOpenA
InternetCloseHandle

gdiplus

GdipDeleteBrush
GdipFillRectangle
GdipCreateTexture
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusStartup
GdipSetPixelOffsetMode
GdipGetImageHeight
GdipDeleteGraphics
GdipGetImageWidth
GdipGraphicsClear
GdipDrawImageRectRect

atl

ord11
ord42

uxtheme

DrawThemeParentBackground

winhttp

WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpConnect
WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpOpen
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpSetCredentials
WinHttpSetTimeouts
WinHttpReadData

ws2_32

recv
select
WSACleanup
WSAStartup
closesocket
send

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

rasapi32

RasGetConnectStatusA
RasHangUpA

Exports

Exports

DirectInput8Create
��DLL��֤

Sections

.text
Size: 592KB - Virtual size: 589KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 764KB - Virtual size: 968KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

271b481450f3d89da9fa7db61ebbd6b5

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

gdi32

comctl32

wininet

gdiplus

atl

uxtheme

winhttp

ws2_32

winspool.drv

rasapi32

Exports

Exports

Sections

.text Size: 592KB - Virtual size: 589KB

.rdata Size: 28KB - Virtual size: 26KB

.data Size: 764KB - Virtual size: 968KB

.reloc Size: 48KB - Virtual size: 46KB

.text
Size: 592KB - Virtual size: 589KB

.rdata
Size: 28KB - Virtual size: 26KB

.data
Size: 764KB - Virtual size: 968KB

.reloc
Size: 48KB - Virtual size: 46KB