Behavioral task
behavioral1
Sample
b8493c45db398dcb77e0c96272f5ff0596102a070c6f4fa2ebb38cee56f5f8bc.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
b8493c45db398dcb77e0c96272f5ff0596102a070c6f4fa2ebb38cee56f5f8bc.exe
Resource
win10v2004-20240802-en
General
-
Target
b8493c45db398dcb77e0c96272f5ff0596102a070c6f4fa2ebb38cee56f5f8bc
-
Size
53KB
-
MD5
699c11164b5ae66a0f655c1f87e1904c
-
SHA1
ed2dd1125f124126a2cccfd975a03f6633073c03
-
SHA256
b8493c45db398dcb77e0c96272f5ff0596102a070c6f4fa2ebb38cee56f5f8bc
-
SHA512
8be3539e323137b4e634226a9991456100d98cc2b701a55c94c717b65f0989080f00fdb35de7834eca6250020f76f4c23522861deac76580007101c8e6b97f41
-
SSDEEP
768:8vId0vvZ9lRfj+t+AD1WTO7qzDbNqmUhJOAets53JhxPi:8JvZFjcBWZx6OAeU34
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b8493c45db398dcb77e0c96272f5ff0596102a070c6f4fa2ebb38cee56f5f8bc
Files
-
b8493c45db398dcb77e0c96272f5ff0596102a070c6f4fa2ebb38cee56f5f8bc.exe windows:4 windows x86 arch:x86
e146922a11411e0bf7abeabae1a0441d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCommandLineA
LCMapStringA
ReadFile
GetModuleFileNameA
CreateFileA
LeaveCriticalSection
EnterCriticalSection
MoveFileA
WriteFile
CloseHandle
DeleteFileA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
GetModuleHandleA
GetEnvironmentVariableA
DeleteCriticalSection
GetFileSize
InitializeCriticalSection
user32
wvsprintfA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
EnableWindow
GetParent
IsWindowEnabled
GetForegroundWindow
IsWindow
GetActiveWindow
SetActiveWindow
SetForegroundWindow
wsprintfA
MessageBoxA
advapi32
RegOpenKeyA
RegQueryValueExA
RegCloseKey
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
ws2_32
WSAStartup
socket
htons
inet_addr
connect
closesocket
send
recv
WSACleanup
msvcrt
??2@YAPAXI@Z
sprintf
__CxxFrameHandler
free
malloc
atoi
_ftol
modf
realloc
memmove
strncmp
??3@YAXPAX@Z
strrchr
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
Sections
.text Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ