Behavioral task
behavioral1
Sample
98dd4a66adfaaa351277aed81c8868e60ebc86aa2ab1fdb9e8250e93451093f6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
98dd4a66adfaaa351277aed81c8868e60ebc86aa2ab1fdb9e8250e93451093f6.exe
Resource
win10v2004-20240802-en
General
-
Target
98dd4a66adfaaa351277aed81c8868e60ebc86aa2ab1fdb9e8250e93451093f6
-
Size
8.6MB
-
MD5
3d60d65480e771eb924fc19d49151362
-
SHA1
792e8c478b385f3ac38b38b20cb0519c264c2ed1
-
SHA256
98dd4a66adfaaa351277aed81c8868e60ebc86aa2ab1fdb9e8250e93451093f6
-
SHA512
055dbcb3228a9d5c2b0aa23140b9eaa517a7ed2577dbfb6d25ff81a2e386e2a1ad63ae48249321314b2c032872c67ffce07f7ce8d213618e3404410a9523cc85
-
SSDEEP
98304:TRoeO6XTBJYazImknGzZr+HIPFtmOZ9G17xwFB5URUSKnaSOdroSCa:NoeO6XTYxmknGzwHIPHd9swFBubKT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Mimikatz family
-
mimikatz is an open source tool to dump credentials on Windows 1 IoCs
resource yara_rule sample mimikatz -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 98dd4a66adfaaa351277aed81c8868e60ebc86aa2ab1fdb9e8250e93451093f6 -
NSIS installer 1 IoCs
resource yara_rule sample nsis_installer_2
Files
-
98dd4a66adfaaa351277aed81c8868e60ebc86aa2ab1fdb9e8250e93451093f6.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 400KB - Virtual size: 399KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6.1MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE