Behavioral task
behavioral1
Sample
0b6e2873a9e0062da0e7c8b849e9b058e9ed4b7fe68db7b3c30d60bf78c8cdd2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0b6e2873a9e0062da0e7c8b849e9b058e9ed4b7fe68db7b3c30d60bf78c8cdd2.exe
Resource
win10v2004-20240802-en
General
-
Target
0b6e2873a9e0062da0e7c8b849e9b058e9ed4b7fe68db7b3c30d60bf78c8cdd2
-
Size
1.5MB
-
MD5
4f13135ece582443b127ba711f567915
-
SHA1
a91ec0c18b27d861e407441e7e2627947c6d62fe
-
SHA256
0b6e2873a9e0062da0e7c8b849e9b058e9ed4b7fe68db7b3c30d60bf78c8cdd2
-
SHA512
a0b65a218dee3d023da0d7029485a20f9a2f6142bfe8b3be5e3c36ff6d4e7d733b66750c29b628496f063640b451881ea5ab58d87b8440fa77421be84e886cd8
-
SSDEEP
24576:6ZMqHNJShNGxfBAWP8DQt+EVjyoO0SzKXjaI57EKAsoPSJAsNFU09vuL0tv:+MqHNJShNsgQZO0BXjasEKroPSJZNF9x
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b6e2873a9e0062da0e7c8b849e9b058e9ed4b7fe68db7b3c30d60bf78c8cdd2
Files
-
0b6e2873a9e0062da0e7c8b849e9b058e9ed4b7fe68db7b3c30d60bf78c8cdd2.exe windows:4 windows x86 arch:x86
b08bd9846dbcb14e5394310a2fb7a326
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32First
Process32Next
CloseHandle
OpenProcess
TerminateProcess
GetCurrentProcess
IsWow64Process
VirtualAlloc
VirtualFree
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
ReadFile
GetFileSize
CreateFileA
DeleteFileA
CreateToolhelp32Snapshot
Sleep
WaitForSingleObject
CreateProcessA
GetStartupInfoA
GetLocalTime
GetPrivateProfileStringA
GetFileAttributesA
LCMapStringA
GetCommandLineA
FreeLibrary
GetProcAddress
GetWindowsDirectoryA
CreateFileMappingA
GetModuleFileNameA
LoadLibraryA
GetCurrentProcessId
MapViewOfFile
WriteFile
DeleteCriticalSection
CreateThread
user32
PeekMessageA
wvsprintfA
GetMessageA
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
advapi32
LookupPrivilegeValueA
OpenProcessToken
shlwapi
PathFileExistsA
msvcrt
free
malloc
modf
??3@YAXPAX@Z
??2@YAPAXI@Z
_atoi64
strncpy
strrchr
strchr
realloc
memmove
strncmp
__CxxFrameHandler
div
atol
_i64toa
atoi
sprintf
rand
srand
_ftol
shell32
ShellExecuteA
Sections
.text Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 671KB - Virtual size: 756KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zw0 Size: 736KB - Virtual size: 735KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ