blacknet

General

Target
ecd9ab6a47b15527bc306ab61275ea73.dat
Size 100KB
Sample211214-pg3bzagfhn
SHA256 09d34d9a31b852a03000de7f06ee5df53e9af161060a5423ef706cefda4bb5ab
MD5 b8faa6d95d83d425202d14b8c9780d34
SHA1 b0056894f1cd8a9cf9c066947b2717d85124d83a
SHA512 a542969870b40b689b4252c3444c4f8320aa904b99d3b33f4f84ccb7cd4b5c42199ef8bae12c6bd3ac6794031a7bcc0abd54cfa5d3bb14c8b9e11ad17d8c8483
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

blacknet

Version

v3.7.0 Public

Botnet

ZUHfTJ

C2

https://dima1111363.asyx.ru

Mutex

BN[79aec5c26bc4ae83b8cfa57c87d3cef2]

Attributes

antivm
false
elevate_uac
false
install_name
WindowsUpdate.exe
splitter
|BN|
start_name
e162b1333458a713bc6916cc8ac4110c
startup
true
usb_spread
true

aes.plain

Targets

- Target
  ecd9ab6a47b15527bc306ab61275ea73.dat
- Size 100KB
- SHA256 09d34d9a31b852a03000de7f06ee5df53e9af161060a5423ef706cefda4bb5ab
- MD5 b8faa6d95d83d425202d14b8c9780d34
- SHA1 b0056894f1cd8a9cf9c066947b2717d85124d83a
- SHA512 a542969870b40b689b4252c3444c4f8320aa904b99d3b33f4f84ccb7cd4b5c42199ef8bae12c6bd3ac6794031a7bcc0abd54cfa5d3bb14c8b9e11ad17d8c8483
- MD5 SHA1 SHA512
Score

10^/10

persistence suricata blacknet zuhftj trojan
- BlackNET
  BlackNET is an open source remote access tool written in VB.NET.
  trojan blacknet
- BlackNET Payload
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- suricata: ET MALWARE Win32/BlackNET CnC Keep-Alive
  suricata: ET MALWARE Win32/BlackNET CnC Keep-Alive
  suricata
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

BlackNET Payload

Contains code to disable Windows Defender

suricata: ET MALWARE Win32/BlackNET CnC Keep-Alive

Executes dropped EXE

Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2