blackmoon | a5cd408ba5dd2425f588f8e09a0b32cb85252696412891e0cc6ca28bc9893001

Sharing

Copy URL Twitter E-mail

General

Target

a5cd408ba5dd2425f588f8e09a0b32cb85252696412891e0cc6ca28bc9893001
Size

1.5MB
MD5

ecfe58de6c7e889b1e0373338113fa0c
SHA1

745a48b29c0bb5a611c2ea6c8b073b9e2f7b452f
SHA256

a5cd408ba5dd2425f588f8e09a0b32cb85252696412891e0cc6ca28bc9893001
SHA512

e066d734be0f2fe30e66e85b13b062195e3c058138d3e5dd49d8396fc78dd5bd38fda5013b61c25313b0200b39904dd04b161fd45da3c1cc561d7482d8bbd1d1
SSDEEP

24576:a8KwjGqo6oUj9CPwJq7aIM6KR7s07ZuaqW/bO:h/GWqCYMuvU

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5cd408ba5dd2425f588f8e09a0b32cb85252696412891e0cc6ca28bc9893001

Files

a5cd408ba5dd2425f588f8e09a0b32cb85252696412891e0cc6ca28bc9893001
.dll windows:4 windows x86 arch:x86

41ea1622ef8849c3b913b683baa852ea

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualProtect
CreateThread
InterlockedIncrement
InterlockedDecrement
HeapFree
RtlMoveMemory
VirtualAlloc
HeapAlloc
GetProcessHeap
lstrlenW
RtlZeroMemory
HeapDestroy
MulDiv
LocalFree
lstrcmpA
CloseHandle
GetTickCount
CreateWaitableTimerA
SetWaitableTimer
MultiByteToWideChar
WideCharToMultiByte
VirtualQueryEx
VirtualProtectEx
GetCurrentProcessId
OpenProcess
TerminateProcess
IsDebuggerPresent
OpenEventA
GlobalAlloc
InterlockedExchange
SetEnvironmentVariableA
CompareStringW
CompareStringA
LCMapStringA
GetCommandLineA
SetEndOfFile
GetLocalTime
SetFilePointer
GetStartupInfoA
CreateProcessA
WaitForSingleObject
CreateDirectoryA
GetPrivateProfileStringA
WriteFile
Sleep
GetFileSize
ReadFile
FindFirstFileA
RemoveDirectoryA
DeleteFileA
FindNextFileA
FindClose
IsBadReadPtr
HeapReAlloc
ExitProcess
CreateFileA
DeviceIoControl
VirtualFree
lstrcpynA
Process32Next
HeapCreate
lstrcmpiA
LoadLibraryA
GetSystemDirectoryA
FreeLibrary
CreateEventA
lstrcpyn
Thread32Next
Thread32First
CreateToolhelp32Snapshot
GlobalFree
lstrlenA
GetTempPathA
GetWindowsDirectoryA
GetVersionExA
GetLastError
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateThread
Process32First
GlobalUnlock
GlobalLock
lstrcpyA
SetLastError
lstrcatA
GetTimeZoneInformation
GetModuleFileNameA
GetVersion
GetCurrentThreadId
GetCurrentThread
GlobalDeleteAtom
FlushFileBuffers
LocalAlloc
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
SetErrorMode
GlobalFlags
WritePrivateProfileStringA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
GetCPInfo
GetOEMCP
RtlUnwind
GetSystemTime
RaiseException
GetACP
HeapSize
SetStdHandle
GetFileType
SetHandleCount
GetStdHandle
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
IsBadWritePtr
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr

user32

GrayStringA
UnhookWindowsHookEx
UnregisterClassA
GetDlgCtrlID
GetMenuItemCount
SetWindowPos
SetFocus
GetWindowPlacement
IsIconic
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
MapWindowPoints
LoadStringA
DestroyMenu
GetLastActivePopup
SetCursor
GetWindow
PtInRect
IsWindowVisible
GetWindowLongA
DrawTextA
GetCursorPos
SetWindowLongA
GetDlgItem
FindWindowA
TabbedTextOutA
ClientToScreen
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
MessageBoxA
FindWindowExA
GetWindowThreadProcessId
SetTimer
KillTimer
LoadIconA
LoadCursorA
RegisterClassW
GetDC
ReleaseDC
DefWindowProcW
SetWindowLongW
ShowWindow
DestroyWindow
SendMessageW
GetWindowRect
GetParent
ScreenToClient
GetWindowLongW
MoveWindow
GetSysColor
GetSysColorBrush
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
GetClassNameA
GetWindowTextLengthW
GetClientRect
DrawTextW
PrintWindow
TrackMouseEvent
AdjustWindowRectEx
SystemParametersInfoA
CreateWindowExW
IsWindowEnabled
EnableWindow
SetLayeredWindowAttributes
InvalidateRect
SetWindowTextA
SendMessageA
PostMessageA
MsgWaitForMultipleObjects
GetWindowTextLengthA
GetWindowTextA
GetMessageW
GetAncestor
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
PostQuitMessage
IsWindow
wsprintfA
DispatchMessageA
GetMessageA
PeekMessageA
EnableMenuItem
GetSystemMetrics
SetForegroundWindow
GetActiveWindow
GetForegroundWindow
GetFocus
GetNextDlgTabItem
GetKeyState
CallNextHookEx
ValidateRect
SetWindowsHookExA

advapi32

DeleteService
ControlService
StartServiceA
CloseServiceHandle
OpenServiceA
CreateServiceA
OpenSCManagerA
CryptDecrypt
CryptGetKeyParam
CryptDestroyKey
CryptSetKeyParam
CryptEncrypt
CryptImportKey
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptReleaseContext
CryptAcquireContextA
RegQueryValueExA
RegOpenKeyA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey

shell32

SHGetSpecialFolderPathA
DragQueryFileW
DragFinish

ole32

CLSIDFromString

shlwapi

StrDupW
wvnsprintfA
PathFileExistsA

gdi32

GetClipBox
CreateSolidBrush
StretchBlt
SetStretchBltMode
GetObjectA
CreateCompatibleBitmap
DeleteObject
BitBlt
CreateDIBSection
CreateCompatibleDC
SelectObject
SetBkMode
SetBkColor
SetTextColor
GetDeviceCaps
GetStockObject
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
DeleteDC
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
SetMapMode
RestoreDC
SaveDC
CreateBitmap

comctl32

ord17
InitCommonControlsEx

wininet

InternetGetCookieA
InternetSetCookieA
InternetCanonicalizeUrlA
InternetCrackUrlA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile
InternetConnectA
InternetSetOptionA
InternetOpenA
InternetCloseHandle

gdiplus

GdipDeleteBrush
GdipFillRectangle
GdipCreateTexture
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusStartup
GdipSetPixelOffsetMode
GdipGetImageHeight
GdipDeleteGraphics
GdipGetImageWidth
GdipGraphicsClear
GdipDrawImageRectRect

atl

ord11
ord42

uxtheme

DrawThemeParentBackground

winhttp

WinHttpQueryHeaders
WinHttpSetOption
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpAddRequestHeaders
WinHttpSetCredentials
WinHttpSetTimeouts
WinHttpReadData
WinHttpQueryDataAvailable

ws2_32

recv
select
WSACleanup
WSAStartup
closesocket
send

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

rasapi32

RasGetConnectStatusA
RasHangUpA

Exports

Exports

DirectInput8Create
��DLL��֤

Sections

.text
Size: 620KB - Virtual size: 617KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 852KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

41ea1622ef8849c3b913b683baa852ea

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

gdi32

comctl32

wininet

gdiplus

atl

uxtheme

winhttp

ws2_32

winspool.drv

rasapi32

Exports

Exports

Sections

.text Size: 620KB - Virtual size: 617KB

.rdata Size: 28KB - Virtual size: 26KB

.data Size: 852KB - Virtual size: 1.0MB

.reloc Size: 48KB - Virtual size: 46KB

.text
Size: 620KB - Virtual size: 617KB

.rdata
Size: 28KB - Virtual size: 26KB

.data
Size: 852KB - Virtual size: 1.0MB

.reloc
Size: 48KB - Virtual size: 46KB