Overview
overview
10Static
static
10Moon.zip
windows7-x64
10Moon.zip
windows10-2004-x64
1Moon/Boots...on.exe
windows7-x64
10Moon/Boots...on.exe
windows10-2004-x64
10Moon/ForlornApi.dll
windows7-x64
1Moon/ForlornApi.dll
windows10-2004-x64
1Moon/Forlo...ct.dll
windows7-x64
1Moon/Forlo...ct.dll
windows10-2004-x64
7Moon/MoonBETA.exe
windows7-x64
1Moon/MoonBETA.exe
windows10-2004-x64
1Moon/MoonB...OT.exe
windows7-x64
3Moon/MoonB...OT.exe
windows10-2004-x64
1Moon/works...481.js
windows7-x64
3Moon/works...481.js
windows10-2004-x64
3Moon/works...ary.js
windows7-x64
3Moon/works...ary.js
windows10-2004-x64
3Moon/works...ler.js
windows7-x64
3Moon/works...ler.js
windows10-2004-x64
3Moon/works...sha.js
windows7-x64
3Moon/works...sha.js
windows10-2004-x64
3Moon/works...ipt.js
windows7-x64
3Moon/works...ipt.js
windows10-2004-x64
3Moon/works...sal.js
windows7-x64
3Moon/works...sal.js
windows10-2004-x64
3Analysis
-
max time kernel
94s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 18:26
Behavioral task
behavioral1
Sample
Moon.zip
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
Moon.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Moon/BootstraperRunmethenopenMoon.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Moon/BootstraperRunmethenopenMoon.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Moon/ForlornApi.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Moon/ForlornApi.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Moon/ForlornInject.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Moon/ForlornInject.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Moon/MoonBETA.exe
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
Moon/MoonBETA.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Moon/MoonBETARUNBOOT.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Moon/MoonBETARUNBOOT.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Moon/workspace/vape/CustomModules/6872274481.js
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
Moon/workspace/vape/CustomModules/6872274481.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Moon/workspace/vape/GuiLibrary.js
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Moon/workspace/vape/GuiLibrary.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Moon/workspace/vape/Libraries/entityHandler.js
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Moon/workspace/vape/Libraries/entityHandler.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Moon/workspace/vape/Libraries/sha.js
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
Moon/workspace/vape/Libraries/sha.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Moon/workspace/vape/MainScript.js
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Moon/workspace/vape/MainScript.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Moon/workspace/vape/Universal.js
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Moon/workspace/vape/Universal.js
Resource
win10v2004-20241007-en
General
-
Target
Moon.zip
-
Size
10.5MB
-
MD5
afdea462c07a140b63f6910a7b18e935
-
SHA1
2bb124b1f6cbeb9126eab1f70561e6bd5a3642ba
-
SHA256
c48b1d0562f49f921b34fa58c952a4dd991d111003c3543f8852fdddb0b0da4f
-
SHA512
52a53c5f60ff6725705b9f7581cb69d2140b9f36804ce2987347ffff3e5fc3244fa9e5b5ab062989419dd0dfd6943f1af8b009cf16745d62b2cfa171f58499ab
-
SSDEEP
196608:AdHOE10T4CiiCRuTnNIa216yWM4yaAJWriqQxwGuKcya190r0uPTqkbOa//:AdHgGiCRu6a3yWMP02qQxFAywTuPTqkl
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 4120 7zFM.exe Token: 35 4120 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4120 7zFM.exe