blackmoon | e83e1a905bea3a3e042a622e7408b4281c20739515dd047d07f42d2e63c17e8aN

Sharing

Copy URL

Twitter E-mail

General

Target

e83e1a905bea3a3e042a622e7408b4281c20739515dd047d07f42d2e63c17e8aN
Size

1.5MB
MD5

885e3ec97f6600f839e56979c3e6e760
SHA1

9a330a063a9081fd9c028e7e5cdcf797d21c8fdf
SHA256

e83e1a905bea3a3e042a622e7408b4281c20739515dd047d07f42d2e63c17e8a
SHA512

94ed16c7c6d0b058edb55a779c8a362c6b37109301569c99f5f3b384cb6db6c2aefe2dc4476c7a73f8ba2b5630c59efa152a70ef5307e7b214de9dc6510d1457
SSDEEP

24576:L++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdu:L1/kjtPlERDGnlRANRdu

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e83e1a905bea3a3e042a622e7408b4281c20739515dd047d07f42d2e63c17e8aN

Files

e83e1a905bea3a3e042a622e7408b4281c20739515dd047d07f42d2e63c17e8aN
.exe windows:4 windows

302671f738d54ae3f3069cbef937f99c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateThread
WaitForSingleObject
TerminateThread
CloseHandle
OpenProcess
WideCharToMultiByte
GetModuleHandleA
ExitProcess
HeapReAlloc
IsBadReadPtr
GetCommandLineA
GetModuleFileNameA
ReadFile
GetFileSize
WritePrivateProfileStringA
GetLocalTime
WriteFile
GetTickCount
GetPrivateProfileStringA
DeleteFileA
GetEnvironmentVariableA
FindClose
FindNextFileA
RemoveDirectoryA
FindFirstFileA
MultiByteToWideChar
GetUserDefaultLCID
SetFilePointer
SetEndOfFile
LCMapStringA
FreeLibrary
GetProcAddress
LoadLibraryA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
CreateFileA
GetStringTypeA
HeapFree
HeapAlloc
GetProcessHeap
GlobalMemoryStatusEx
RtlMoveMemory
lstrcpyn
SetWaitableTimer
CreateWaitableTimerA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetOEMCP
GetACP
GetCPInfo
IsBadWritePtr
VirtualAlloc
RaiseException
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetLastError
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
GetCurrentThreadId
DeleteCriticalSection
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
InterlockedIncrement
InterlockedDecrement
GetVersion
GetStartupInfoA
MoveFileA
GetStringTypeW
CreateDirectoryA

shlwapi

PathMatchSpecA
PathFileExistsA
PathIsDirectoryA

urlmon

URLDownloadToFileA

shell32

SHGetPathFromIDList
SHGetSpecialFolderLocation
ShellExecuteA

advapi32

RegCloseKey
CryptCreateHash
RegQueryValueExA
RegEnumKeyA
RegOpenKeyA
CryptAcquireContextA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext

user32

TranslateMessage
DispatchMessageA
MessageBoxA
wsprintfA
PeekMessageA
CallWindowProcA
EnumDisplaySettingsA
MsgWaitForMultipleObjects
wvsprintfA
GetMessageA

ole32

CoUninitialize
OleRun
CoCreateInstance
CoInitialize
CLSIDFromString
CLSIDFromProgID

wininet

InternetCloseHandle
InternetOpenA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
InternetReadFile
HttpQueryInfoA
InternetSetCookieA
InternetOpenUrlA
InternetConnectA

psapi

EnumProcesses

oleaut32

SafeArrayGetLBound
SafeArrayGetDim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantInit
VariantChangeType
SafeArrayDestroyDescriptor
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy

Sections

.text
Size: 360KB - Virtual size: 357KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

302671f738d54ae3f3069cbef937f99c

Headers

File Characteristics

Imports

kernel32

shlwapi

urlmon

shell32

advapi32

user32

ole32

wininet

psapi

oleaut32

Sections

.text Size: 360KB - Virtual size: 357KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 1.2MB - Virtual size: 1.2MB

.rsrc Size: 20KB - Virtual size: 16KB

.text
Size: 360KB - Virtual size: 357KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 1.2MB - Virtual size: 1.2MB

.rsrc
Size: 20KB - Virtual size: 16KB