General
-
Target
B30EEBF734354F55373978E395C912393F3C674AAA471.exe
-
Size
117KB
-
MD5
b72d429d1d690165c7b0de4a074c4a58
-
SHA1
f0704d227482a80f2f90dab79ed4acd9770fe565
-
SHA256
b30eebf734354f55373978e395c912393f3c674aaa4717748ae449b09832f6ae
-
SHA512
f3b565e67d5a15d5305982701bd5f0d37eec0bfe2d152556584fa1d01faf1def6e616d0addea91e0663be084450b49f99e2108cc06a9b50c9e1482f9290b6c5c
Score
10/10
Malware Config
Extracted
Family
blacknet
Version
v3.7.0 Public
Botnet
Bot
C2
http://furyx.de/panel
Mutex
BN[c1916af6f3a468e5b6f5c7f6b9c78982]
Attributes
-
antivm
false
-
elevate_uac
false
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
e162b1333458a713bc6916cc8ac4110c
-
startup
false
-
usb_spread
true
aes.plain
Signatures
-
BlackNET Payload 1 IoCs
-
Blacknet family
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Files
-
B30EEBF734354F55373978E395C912393F3C674AAA471.exe