Behavioral task
behavioral1
Sample
20240912ac0cef73f8b3f5bba6009e962c823770icedid.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
20240912ac0cef73f8b3f5bba6009e962c823770icedid.exe
Resource
win10v2004-20240802-en
General
-
Target
20240912ac0cef73f8b3f5bba6009e962c823770icedid
-
Size
4.4MB
-
MD5
ac0cef73f8b3f5bba6009e962c823770
-
SHA1
e170bda5fd9ed529a21e5b26f45521d1504badf4
-
SHA256
cb506b59df972a5a5e61bb7f414e41309b8b16fb55981da4a38a3fb91bd9407a
-
SHA512
d6478b02fbadcc4df32879d6854e015650e6523c4e3d94298916d64a5586465b9c2009e293fdc4bdf8d8c0584d3c60828f8db21f4c3b3e004bb7853b949847d3
-
SSDEEP
98304:xNz4DFUm09ylG4ABXlOnWL9wnCwosEwemp:oirvBXYg9wnh3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 20240912ac0cef73f8b3f5bba6009e962c823770icedid
Files
-
20240912ac0cef73f8b3f5bba6009e962c823770icedid.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12.7MB - Virtual size: 12.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 172KB - Virtual size: 615KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ