Behavioral task
behavioral1
Sample
香肠留恋免费版0429.exe
Resource
win7-20240903-en
General
-
Target
e0adc69b5077af4c519251e855fe9a01f9b7385aeae10baf51183c64b5168a48
-
Size
36KB
-
MD5
7b3d72a40ebfd5e961fb0b95e9896514
-
SHA1
c759708140ef899a3337c7f8faeccf12db59a1db
-
SHA256
e0adc69b5077af4c519251e855fe9a01f9b7385aeae10baf51183c64b5168a48
-
SHA512
d29f3d37a73d81c4398d6f513de9f49a5afa06a5162ac332dcdf95d31a2d69469d7e6f00537cc7c86611b49d07fe0edb316a3d4cd2f4c52242d1007642900d71
-
SSDEEP
768:s54zTqUopUB4v47o3nR99SmZznGAKjki3td8f4Bx2wI:doC7YnRSmZzntUvA4Gv
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule static1/unpack002/out.upx family_blackmoon -
resource yara_rule static1/unpack001/香肠留恋免费版0429.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/香肠留恋免费版0429.exe unpack002/out.upx
Files
-
e0adc69b5077af4c519251e855fe9a01f9b7385aeae10baf51183c64b5168a48.zip
-
先看说明.txt
-
香肠留恋免费版0429.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE