blackmoon | 0ebfef7d6059b82e87e05a54e80e5a7b[.]virus

Sharing

Copy URL Twitter E-mail

General

Target

0ebfef7d6059b82e87e05a54e80e5a7b.virus
Size

2.6MB
MD5

0ebfef7d6059b82e87e05a54e80e5a7b
SHA1

3c1ab9c072625b9e08b72013967b04bd2e0cb69e
SHA256

4695fbf41abd54d1449d8da4a5976d50aec0499e3e2959e20686237d32db3114
SHA512

a695816e77c3d569ba861fab022035910858cf2db0e15dd2a58398c6f39394add35172ca209de1d0d02019f5f0a4f35beb8e3ea56c4e0c37cb645379d1d9e5c9
SSDEEP

24576:3bsATQUIP6braCWyv6BpHv+LOez9OulOcsV9DK2J2aBcpsam5RvikgJkf:3vbDCv+HOulOcQMYYsP5RviP6

Score

10^/10

blackmoon gh0strat mimikatz

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat
Mimikatz family
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
sample	mimikatz

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ebfef7d6059b82e87e05a54e80e5a7b.virus

Files

0ebfef7d6059b82e87e05a54e80e5a7b.virus
.exe windows:4 windows x86 arch:x86

51d221b5a5480b851c728b6c40a01d6b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

listen
WSACleanup
bind
setsockopt
htons
inet_addr
ioctlsocket
closesocket
connect
socket
inet_ntoa
recv
send
getpeername
ntohs
htonl
recvfrom
sendto
gethostname
gethostbyname
getsockname
accept
select
__WSAFDIsSet
shutdown
WSAStartup

kernel32

CreateEventA
CreateToolhelp32Snapshot
Process32First
CloseHandle
LCMapStringA
LoadLibraryA
FreeLibrary
GetCommandLineA
GetVersionExA
Sleep
DeleteFileA
GetStartupInfoA
WaitForSingleObject
GetLocalTime
FindFirstFileA
FindClose
GlobalLock
Process32Next
GetNativeSystemInfo
GetModuleHandleA
GetProcAddress
GetLocaleInfoA
GetDateFormatA
GetTimeFormatA
lstrcpyn
GetCurrentProcess
MultiByteToWideChar
lstrlenW
WideCharToMultiByte
CreateWaitableTimerA
SetWaitableTimer
SetEnvironmentVariableA
CompareStringW
CompareStringA
IsBadCodePtr
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
LCMapStringW
IsBadWritePtr
VirtualAlloc
VirtualFree
GlobalUnlock
GetUserDefaultLCID
GetFileSize
CreateFileA
WriteFile
GetTickCount
GetModuleFileNameA
IsBadReadPtr
HeapReAlloc
ExitProcess
GetExitCodeProcess
ReadFile
PeekNamedPipe
CreateProcessA
CreatePipe
lstrcatA
HeapFree
RtlMoveMemory
HeapAlloc
GetProcessHeap
GlobalFree
GlobalAlloc
CopyFileA
lstrlenA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetTimeZoneInformation
SetLastError
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetLastError
CreateThread
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
InterlockedIncrement
InterlockedDecrement
LocalFree
lstrcpynA
lstrcpyA
LocalAlloc
SetFilePointer
FlushFileBuffers
HeapCreate
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
MulDiv
GlobalFlags
WritePrivateProfileStringA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetVersion
LockResource
LoadResource
FindResourceA
GetProcessVersion
SetErrorMode
GetCPInfo
GetOEMCP
RtlUnwind
TerminateProcess
RaiseException
GetSystemTime
GetACP
HeapSize
SetStdHandle
GetFileType
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetEnvironmentVariableA
HeapDestroy
OpenEventA

user32

PtInRect
GetWindowRect
GetDlgCtrlID
GetWindow
ClientToScreen
UnhookWindowsHookEx
GetMenuItemCount
GetDC
ReleaseDC
TabbedTextOutA
DrawTextA
GrayStringA
GetDlgItem
SendDlgItemMessageA
IsDialogMessageA
SetWindowLongA
ShowWindow
SetFocus
GetWindowPlacement
SystemParametersInfoA
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
DestroyWindow
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
GetSystemMetrics
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
UpdateWindow
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
UnregisterClassA
PostThreadMessageA
DestroyMenu
CreateDialogIndirectParamA
EndDialog
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetKeyState
CallNextHookEx
ValidateRect
GetCursorPos
SetWindowsHookExA
GetLastActivePopup
GetWindowLongA
SetCursor
SendMessageA
PostMessageA
PostQuitMessage
SetForegroundWindow
SetActiveWindow
GetActiveWindow
GetForegroundWindow
IsWindowEnabled
GetParent
EnableWindow
SetWindowTextA
GetWindowThreadProcessId
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
LoadBitmapA
GetWindowTextA
GetClassNameA
SetWindowPos
IsIconic
OpenIcon
MsgWaitForMultipleObjects
GetInputState
IsWindow
FindWindowExA
IsWindowVisible
GetMenuState
CallWindowProcA
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
GetWindowTextLengthA

gdi32

GetDeviceCaps
CreateBitmap
PtVisible
RectVisible
TextOutA
Escape
ExtTextOutA
GetObjectA
GetStockObject
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
SetBkColor
SelectObject
RestoreDC
SaveDC
DeleteDC
DeleteObject

advapi32

EnumServicesStatusA
ChangeServiceConfigA
ControlService
StartServiceA
DeleteService
CreateServiceA
GetServiceKeyNameA
GetServiceDisplayNameA
ChangeServiceConfig2A
QueryServiceConfig2A
QueryServiceConfigA
CloseServiceHandle
QueryServiceStatus
OpenServiceA
OpenSCManagerA
GetUserNameA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
RegDeleteValueA
RegDeleteKeyA
EnumServicesStatusExA
EnumDependentServicesA
RegCreateKeyA
RegOpenKeyA
RegEnumKeyA
RegQueryInfoKeyA
RegEnumValueA
RegQueryValueExA
RegFlushKey

ole32

OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleUninitialize
OleInitialize
CoRegisterMessageFilter
CoInitialize
CoUninitialize
OleRun
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoFreeUnusedLibraries

oleaut32

VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
VariantTimeToSystemTime

psapi

GetModuleFileNameExA

mpr

WNetCancelConnection2A
WNetAddConnection2A

dnsapi

DnsQuery_A

oledlg

ord8

shlwapi

PathFileExistsA

rasapi32

RasHangUpA
RasGetConnectStatusA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

comctl32

ord17

wininet

InternetOpenA
InternetCloseHandle
InternetSetOptionA
InternetConnectA
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetCrackUrlA
InternetCanonicalizeUrlA

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 276KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.3MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

51d221b5a5480b851c728b6c40a01d6b

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

gdi32

advapi32

ole32

oleaut32

psapi

mpr

dnsapi

oledlg

shlwapi

rasapi32

winspool.drv

comctl32

wininet

shell32

Sections

.text Size: 276KB - Virtual size: 272KB

.rdata Size: 28KB - Virtual size: 25KB

.data Size: 2.3MB - Virtual size: 2.4MB

.rsrc Size: 4KB - Virtual size: 680B

.text
Size: 276KB - Virtual size: 272KB

.rdata
Size: 28KB - Virtual size: 25KB

.data
Size: 2.3MB - Virtual size: 2.4MB

.rsrc
Size: 4KB - Virtual size: 680B