blackmoon | fcd593c33c8e5a92c1fbbf57c5bcc94fcf1be256768613d26d078e76086e6000

Sharing

Copy URL Twitter E-mail

General

Target

fcd593c33c8e5a92c1fbbf57c5bcc94fcf1be256768613d26d078e76086e6000
Size

2.0MB
MD5

cbe9b2faf74d3f9eaa8b07f86ba3194b
SHA1

3ee95ee5ca84ffe72fe7bd01b2d5890cc476f32e
SHA256

fcd593c33c8e5a92c1fbbf57c5bcc94fcf1be256768613d26d078e76086e6000
SHA512

4a3750343147f0ea3c996fba081021fcb7c6c197851056333c528fe343af5c2f3a8911a8968433906b92c3d996c4b7601d92cdfdc18f7ba9d20b8d8e987b7d6d
SSDEEP

24576:IPZbp4THcHviS+W8r8VKD5nopdFUz1DNmwuiD0VZyRZ/rxHKbfb38KpfFnefxk:IbVkFEgj10KObMkfVe2

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Files

fcd593c33c8e5a92c1fbbf57c5bcc94fcf1be256768613d26d078e76086e6000
.exe windows:4 windows x86 arch:x86

7e1f9b8141416c5bf403c44ad5023bd5

Code Sign

0b:87:29:ec:8e:ac:5a:6b:b0:2c:92:93:21:7f:bf:89
Certificate

Issuer

CN=凌峰工作室,ST=Hubei,C=China,1.2.840.113549.1.9.1=#1300

Not Before

23/03/2021, 13:19

Not After

24/12/2040, 16:00

Subject

CN=凌峰工作室,ST=Hubei,C=China,1.2.840.113549.1.9.1=#1300

07
Certificate

Issuer

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:e6:3a:c9:92:ef:67:ba
Certificate

Issuer

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

09/09/2020, 07:00

Not After

09/09/2025, 07:00

Subject

CN=Starfield Timestamp Authority - G2,O=Starfield Technologies\, LLC,L=Scottsdale,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

a1:5e:4c:5e:79:21:9d:1e:85:54:01:c2:99:37:e1:af:a0:23:2c:00
Signer

Actual PE Digest

a1:5e:4c:5e:79:21:9d:1e:85:54:01:c2:99:37:e1:af:a0:23:2c:00

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsA
PathIsDirectoryA

kernel32

SetLastError
GlobalAlloc
lstrcpyA
GetWindowsDirectoryA
GetDriveTypeA
SetFilePointer
GetFileAttributesA
GlobalLock
GlobalUnlock
GlobalFree
LCMapStringA
GetCommandLineA
Sleep
FindFirstFileA
RemoveDirectoryA
FindNextFileA
FindClose
GetEnvironmentVariableA
GetStartupInfoA
CreateProcessA
WaitForSingleObject
GetTickCount
GetModuleFileNameA
DeleteFileA
GetFileSize
ReadFile
GetCurrentDirectoryA
GetDiskFreeSpaceA
MulDiv
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
Thread32Next
Thread32First
GetLastError
lstrcpynA
WriteFile
CreateFileA
DeviceIoControl
RtlMoveMemory
lstrcpyn
LoadLibraryExA
GetCurrentProcessId
TerminateProcess
QueryDosDeviceA
OpenProcess
CreateThread
Module32First
lstrlenA
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateEventA
OpenEventA
OpenThread
GetModuleHandleA
VirtualProtect
FreeLibrary
GetProcAddress
LoadLibraryA
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
GetSystemDirectoryA
GetTempFileNameA
VirtualAllocEx
CopyFileA
CloseHandle
GetTempPathA
GetVersionExA
InterlockedExchange
GetLocaleInfoW
CompareStringW
CompareStringA
SetStdHandle
IsBadCodePtr
GetUserDefaultLCID
EnumSystemLocalesA
IsValidCodePage
IsValidLocale
SetEnvironmentVariableA
SetEnvironmentVariableW
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
LCMapStringW
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetACP
HeapSize
RaiseException
RtlUnwind
GetOEMCP
GetCPInfo
SetErrorMode
GetProcessVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
WritePrivateProfileStringA
GlobalFlags
LocalReAlloc
GlobalReAlloc
GlobalHandle
LocalAlloc
GetFullPathNameA
SetEndOfFile
FlushFileBuffers
LocalFree
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
InterlockedDecrement
CreateSemaphoreA
InterlockedIncrement
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
OpenFileMappingA
MapViewOfFile
SetEvent
UnmapViewOfFile
WaitNamedPipeA
SetNamedPipeHandleState
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetVersion
GetLocaleInfoA
GetTimeZoneInformation
QueryPerformanceCounter
QueryPerformanceFrequency
lstrcatA
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
LCMapStringW
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetACP
HeapSize
RaiseException
TerminateProcess
FindResourceA
RtlUnwind
GetCommandLineA
GetOEMCP
GetCPInfo
FlushFileBuffers
GetCurrentProcess
GetProcessVersion
GetProcAddress
LoadLibraryExA
FreeLibrary
GetModuleHandleA
lstrcpyn
DeviceIoControl
GetWindowsDirectoryA
ResumeThread
LocalSize
WriteProcessMemory
ReadProcessMemory
IsWow64Process
CloseHandle
CreateToolhelp32Snapshot
Process32First
OpenProcess
VirtualQueryEx
CreateFileA
IsBadCodePtr
RtlFillMemory
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
GlobalFlags
GetVersion
lstrcpynA
lstrcpyA
lstrcatA
SetErrorMode
InterlockedDecrement
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
HeapFree
LocalFree
IsBadReadPtr
GetTickCount
GetModuleFileNameA
LocalAlloc
lstrlenA
WriteFile
GlobalDeleteAtom
GlobalAddAtomA
Sleep
lstrcmpA
ReadFile
GetFileSize
LCMapStringA
GetDiskFreeSpaceExA
GetCurrentDirectoryA
GetLocalTime
GetUserDefaultLCID
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
DeleteFileA
SetStdHandle
RtlMoveMemory
MulDiv
SetFilePointer
WritePrivateProfileStringA
LoadLibraryA
GlobalFindAtomA
GetLastError
SetLastError
InterlockedIncrement
LoadResource
LockResource
GlobalGetAtomNameA
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
Process32Next

user32

GetDlgItem
RegisterWindowMessageA
EnumWindows
GetParent
IsWindowVisible
GetWindowThreadProcessId
GetAncestor
FindWindowExA
IsWindow
GetWindowTextA
GetClassNameA
SetWindowPos
IsIconic
OpenIcon
GetForegroundWindow
FindWindowA
MessageBoxTimeoutA
TrackMouseEvent
CallWindowProcA
SetMenuInfo
GetMenuInfo
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
DestroyMenu
LoadStringA
GetSysColorBrush
LoadCursorA
LoadIconA
MapWindowPoints
GetSysColor
AdjustWindowRectEx
GetClientRect
CopyRect
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetSubMenu
GetMenuItemID
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetWindowPlacement
SetFocus
GetMenuItemCount
SetWindowTextA
GetDlgCtrlID
DestroyWindow
UnhookWindowsHookEx
GrayStringA
DrawTextA
TabbedTextOutA
ClientToScreen
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetKeyState
CallNextHookEx
ValidateRect
SetWindowsHookExA
GetLastActivePopup
SetCursor
PostMessageA
PostQuitMessage
SetForegroundWindow
GetActiveWindow
IsWindowEnabled
EnableWindow
GetWindow
PtInRect
GetWindowLongA
GetCursorPos
SetWindowLongA
UnregisterClassA
ShowWindow
SystemParametersInfoA
GetDC
ReleaseDC
SendMessageA
GetWindowRect
GetSystemMetrics
UnregisterClassA
GetClassNameA
PtInRect
GetWindowRect
GetDlgCtrlID
GetWindow
ClientToScreen
SetWindowTextA
GetWindowTextA
GetMenuItemCount
TabbedTextOutA
DrawTextA
GrayStringA
SendDlgItemMessageA
IsDialogMessageA
CreateDialogIndirectParamA
SetWindowPos
ShowWindow
SetFocus
GetSystemMetrics
GetWindowPlacement
IsIconic
SystemParametersInfoA
SetForegroundWindow
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
UnhookWindowsHookEx
DestroyWindow
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
IsWindow
SetActiveWindow
GetSysColor
MapWindowPoints
UpdateWindow
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetActiveWindow
GetKeyState
CallNextHookEx
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
PostThreadMessageA
DestroyMenu
ValidateRect
IsWindowVisible
GetCursorPos
SetWindowsHookExA
GetParent
GetLastActivePopup
GetWindowLongA
EnableWindow
SetCursor
SendMessageA
PostMessageA
PostQuitMessage
EndDialog
wsprintfA
MessageBoxA
ReleaseDC
GetForegroundWindow
GetDlgItem
FindWindowA
RegisterWindowMessageA
GetAncestor
EnumWindows
SetWindowLongA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
CreateWindowExA
GetDC
SetCursorPos
IsWindowEnabled

gdi32

PtVisible
RectVisible
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
GetObjectA
GetStockObject
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
CreateBitmap
TextOutA
ExtTextOutA
Escape
GetDeviceCaps
SelectObject
DeleteDC
DeleteObject
GetObjectA
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
DeleteDC
CreateBitmap
RectVisible
PtVisible
ExtTextOutA
DeleteObject
TextOutA
SetTextColor
SetBkMode
SelectObject
CreateFontIndirectA
Rectangle
GetDeviceCaps
Escape
SetBkColor
GetStockObject
RestoreDC
SaveDC

advapi32

RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
DeleteService
ControlService
StartServiceA
CloseServiceHandle
OpenServiceA
CreateServiceA
OpenSCManagerA
CryptDestroyKey
CryptDecrypt
CryptDeriveKey
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegSetValueExA
RegEnumValueA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyA
RegCreateKeyExA

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
DragAcceptFiles
Shell_NotifyIconA
DragFinish
DragQueryFileA
SHUpdateRecycleBinIcon
SHEmptyRecycleBinA
SHGetSpecialFolderPathA
SHQueryRecycleBinA

atl

ord42
ord42

psapi

GetModuleBaseNameA
GetProcessMemoryInfo
GetProcessImageFileNameA

dbghelp

MakeSureDirectoryPathExists

iphlpapi

GetAdaptersInfo

ws2_32

inet_addr
ntohs
send
setsockopt
recv
select
setsockopt
send
shutdown
recv
socket
htons
getpeername
WSAGetLastError
ntohs
WSACleanup
getservbyname
connect
closesocket
inet_ntoa
gethostbyname
inet_addr
WSAStartup

ole32

CLSIDFromProgID
OleRun
OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CoRegisterMessageFilter
OleUninitialize
CoFreeUnusedLibraries
CoCreateInstance
OleInitialize
CLSIDFromString

oleaut32

LoadTypeLi
VarR8FromBool
LHashValOfNameSys
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
VariantInit
VariantChangeType
RegisterTypeLi
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
VarR8FromCy

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA
ClosePrinter
OpenPrinterA
DocumentPropertiesA

comctl32

ord17
ord17

oledlg

ord8

Sections

.text
Size: 872KB - Virtual size: 871KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.1MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7e1f9b8141416c5bf403c44ad5023bd5

Code Sign

0b:87:29:ec:8e:ac:5a:6b:b0:2c:92:93:21:7f:bf:89Certificate

07Certificate

Key Usages

0b:e6:3a:c9:92:ef:67:baCertificate

Extended Key Usages

Key Usages

a1:5e:4c:5e:79:21:9d:1e:85:54:01:c2:99:37:e1:af:a0:23:2c:00Signer

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

advapi32

shell32

atl

psapi

dbghelp

iphlpapi

ws2_32

ole32

oleaut32

winspool.drv

comctl32

oledlg

Sections

.text Size: 872KB - Virtual size: 871KB

.rdata Size: 56KB - Virtual size: 53KB

.data Size: 1.1MB - Virtual size: 1.3MB

0b:87:29:ec:8e:ac:5a:6b:b0:2c:92:93:21:7f:bf:89
Certificate

07
Certificate

0b:e6:3a:c9:92:ef:67:ba
Certificate

a1:5e:4c:5e:79:21:9d:1e:85:54:01:c2:99:37:e1:af:a0:23:2c:00
Signer

.text
Size: 872KB - Virtual size: 871KB

.rdata
Size: 56KB - Virtual size: 53KB

.data
Size: 1.1MB - Virtual size: 1.3MB