blackmoon | 2025-04-22_f6deb7595cac0ffc23d60f549df2e388_amadey_elex_icedid_rhadamanthys_smoke-loader

Sharing

Copy URL

Twitter E-mail

General

Target

2025-04-22_f6deb7595cac0ffc23d60f549df2e388_amadey_elex_icedid_rhadamanthys_smoke-loader
Size

2.2MB
MD5

f6deb7595cac0ffc23d60f549df2e388
SHA1

0ec45cbd8d61ba548d01e465a96709462defe504
SHA256

9d275d7e4c2f991a967a8c86ca2fce700bcc3b8dbbf89bfd153476a8b2c275e9
SHA512

a3dc122f1a1205d8c98ec1274685872968e2eeafa09c78e7d9ff41cb58b08dda27147b789354ba3bd9691b68ebf6b2557b1718361021e215d87b9c399b5e8226
SSDEEP

24576:F4YKL33onzQqK2vL+Jj/sRJF9PV6GrGkg0Rr5VkMrsTYhsCMAYQWfx5VNRem9Ke+:F6HozTKvJsnFVMkgGdu4ndBWNzEeBp2

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-04-22_f6deb7595cac0ffc23d60f549df2e388_amadey_elex_icedid_rhadamanthys_smoke-loader

Files

2025-04-22_f6deb7595cac0ffc23d60f549df2e388_amadey_elex_icedid_rhadamanthys_smoke-loader
.exe windows:4 windows x86 arch:x86

9d5552b3a103c723c650b0d7a6310980

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
CloseHandle
ReadFile
GetFileSize
FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
Sleep
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
HeapAlloc
FormatMessageA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
GetCurrentProcessId
TerminateProcess
OpenProcess
ExitProcess
GetModuleHandleA
CreateProcessA
MoveFileA
CreateDirectoryA
GetModuleFileNameA
CreateFileA
GetUserDefaultLCID
lstrcpyn
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
SetFilePointer
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
RaiseException
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
GetLastError
GetCurrentProcess
GetStartupInfoA
GetVersion
InterlockedDecrement
InterlockedIncrement
RtlUnwind
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection

user32

PeekMessageA
GetMessageA
TranslateMessage
MessageBoxA
DispatchMessageA
wsprintfA

advapi32

CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
CryptGetHashParam

ole32

CoUninitialize
OleRun
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoInitialize

shlwapi

PathFileExistsA

oleaut32

VariantChangeType
VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SysAllocString
VariantClear
SafeArrayDestroy
SafeArrayCreate

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9d5552b3a103c723c650b0d7a6310980

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shlwapi

oleaut32

shell32

Sections

.text Size: 80KB - Virtual size: 77KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 2.2MB - Virtual size: 2.2MB

.rsrc Size: 4KB - Virtual size: 4KB

.text
Size: 80KB - Virtual size: 77KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 2.2MB - Virtual size: 2.2MB

.rsrc
Size: 4KB - Virtual size: 4KB