blackmoon | 09f9c54c590af7d78addd057e8b0863e5993ffc776dbc1dd4dbbaeada3d52081

Sharing

Copy URL

Twitter E-mail

General

Target

09f9c54c590af7d78addd057e8b0863e5993ffc776dbc1dd4dbbaeada3d52081
Size

2.6MB
MD5

0b8f4d0e1667b5fdbc6061deca073288
SHA1

2792856cc46271292498a04c75d40f0e9afc7fad
SHA256

09f9c54c590af7d78addd057e8b0863e5993ffc776dbc1dd4dbbaeada3d52081
SHA512

6ef453319b0f67a24b6737ee860c1f8ada78564535fde2eae7c0a69301f383432f584f935adbf904e33ed982f1ecaf73e6521657b1ff8eab44561c6cb8ac4850
SSDEEP

24576:kp4EcYzgQetYVKyO9zBH/TUCih+dQfcCi62c8lBHG5tdPsfrmFBuzM7k3wJmOKMr:kpk6hvssfc8OLz53wJWqb2NSH

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09f9c54c590af7d78addd057e8b0863e5993ffc776dbc1dd4dbbaeada3d52081

Files

09f9c54c590af7d78addd057e8b0863e5993ffc776dbc1dd4dbbaeada3d52081
.dll windows:4 windows x86 arch:x86

81bcd1cb43c0f5a508d83f72c7592812

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WideCharToMultiByte
GetTempFileNameA
GetSystemDirectoryA
GetLogicalDriveStringsA
QueryDosDeviceA
MultiByteToWideChar
GetProcessHandleCount
DuplicateHandle
WriteProcessMemory
ReadProcessMemory
lstrcpyn
GetCurrentThreadId
ResumeThread
CreateRemoteThread
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
ReadFile
GetFileSize
CreateFileA
DeleteFileA
MulDiv
GetDiskFreeSpaceA
GetCurrentDirectoryA
VirtualAllocEx
GetCommandLineA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
VirtualAlloc
VirtualFree
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersion
RtlUnwind
InterlockedDecrement
InterlockedIncrement
TerminateProcess
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
CopyFileA
GetTempPathA
OpenThread
GetVersionExA
GetCurrentProcess
CloseHandle
Sleep
GetLastError
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
LCMapStringW
SetFilePointer
IsBadWritePtr
RaiseException
WriteFile
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetACP
GetCPInfo
LCMapStringW
SetFilePointer
RaiseException
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetFileType
GetStdHandle
SetHandleCount
GetLastError
MultiByteToWideChar
WaitForSingleObject
VirtualFreeEx
lstrcpynA
FindClose
lstrcpyn
GetNativeSystemInfo
OpenProcess
GetModuleHandleA
CloseHandle
GetModuleFileNameA
GetCurrentProcess
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
TerminateProcess
InterlockedIncrement
GetOEMCP
RtlUnwind
GetVersion
CreateToolhelp32Snapshot
Process32First
Process32Next
DuplicateHandle
CopyFileA
VirtualAllocEx
WideCharToMultiByte
GetTempFileNameA
GetTempPathA
GetSystemDirectoryA
RtlMoveMemory
WriteProcessMemory
GetWindowsDirectoryA
lstrcpynW
CreateWaitableTimerA
SetWaitableTimer
Module32First
Module32Next
VirtualProtect
VirtualQuery
LoadLibraryExA
FreeLibrary
CreateRemoteThread
GetExitCodeThread
OpenThread
TerminateThread
LeaveCriticalSection
GetVersionExA
HeapCreate
ReadProcessMemory
VirtualQueryEx
CreateProcessA
PeekNamedPipe
lstrlenW
lstrcpyA
InitializeCriticalSection
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
IsBadCodePtr
SetStdHandle
FlushFileBuffers
LoadLibraryA
InterlockedDecrement
GetCurrentThreadId
SetProcessAffinityMask
EnterCriticalSection
DeleteCriticalSection
RtlZeroMemory
IsWow64Process
HeapAlloc
HeapFree
lstrcmpW
lstrcmpiW
GetProcessHeap
ExitProcess
HeapReAlloc
IsBadReadPtr
ReadFile
GetFileSize
CreateFileA
DeleteFileA
WriteFile
GetTickCount
LCMapStringA
GetProcAddress
GetUserDefaultLCID
GetDiskFreeSpaceExA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetStartupInfoA
FindNextFileA
FindFirstFileA
GetCommandLineA

shlwapi

PathFindFileNameA
PathFindFileNameA
StrToIntW
StrToIntExW
PathFindExtensionA
PathFileExistsA
StrToIntExA

user32

PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
MsgWaitForMultipleObjects
CallWindowProcA
SetWindowLongA
GetWindowLongA
RegisterWindowMessageA
GetAncestor
GetWindowThreadProcessId
IsWindowVisible
GetParent
EnumWindows
PostThreadMessageA
MsgWaitForMultipleObjects
GetForegroundWindow
RegisterWindowMessageA
ClientToScreen
SendMessageA
WindowFromPoint
ShowWindow
EnumWindows
GetParent
GetAncestor
CallWindowProcA
PeekMessageA
TranslateMessage
DispatchMessageA
wsprintfA
GetMessageA
MessageBoxA
GetDlgItem
FindWindowA
GetCursorPos
GetClassNameA
GetWindowTextA
GetWindowThreadProcessId
IsWindowVisible

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptHashData
CryptGetHashParam
RegCloseKey
RegQueryValueExA
RegOpenKeyA

ws2_32

WSAStartup
htons
WSACleanup

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

shell32

SHGetSpecialFolderPathA

ole32

CoCreateInstance
OleRun
CoInitialize
CLSIDFromString
CLSIDFromProgID
CoUninitialize

psapi

GetModuleInformation

oleaut32

VariantChangeType
VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
VarR8FromCy
VarR8FromBool
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
SysFreeString

Exports

Exports

True

Sections

.text
Size: 1012KB - Virtual size: 1009KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.5MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

81bcd1cb43c0f5a508d83f72c7592812

Headers

File Characteristics

Imports

kernel32

shlwapi

user32

advapi32

ws2_32

version

shell32

ole32

psapi

oleaut32

Exports

Exports

Sections

.text Size: 1012KB - Virtual size: 1009KB

.rdata Size: 32KB - Virtual size: 30KB

.data Size: 1.5MB - Virtual size: 1.6MB

.rsrc Size: 4KB - Virtual size: 624B

.reloc Size: 44KB - Virtual size: 41KB

.text
Size: 1012KB - Virtual size: 1009KB

.rdata
Size: 32KB - Virtual size: 30KB

.data
Size: 1.5MB - Virtual size: 1.6MB

.rsrc
Size: 4KB - Virtual size: 624B

.reloc
Size: 44KB - Virtual size: 41KB