Overview

overview

10

Static

static

10

b33d569af5...09.exe

windows7_x64

10

b33d569af5...09.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
  • Size 131KB
  • Sample220426-jfe76affem
  • SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
hackedblacknet

Malware Config

Extracted

Family

  • blacknet

Version

  • v3.5 Public

Botnet

  • HacKed

C2

  • http://finalb.xyz/NiggaNet

Mutex

  • BN[RqfcWolJ-7232457]

Attributes
  • antivm

    true

  • elevate_uac

    false

  • install_name

    WindowsUpdate.exe

  • splitter

    |BN|

  • start_name

    df7427b5e05183e625345c3c37ef31c0

  • startup

    true

  • usb_spread

    true

aes.plain

Signatures

  • BlackNET Payload 1 IoCs
  • Blacknet family
    blacknet
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

File Explorer

  • b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
    .exe 131KB

b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

  • IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
  • SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
  • MD5 SHA1 SHA512 SSDEEP
windowsx86

  • BlackNET Payload

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Minor OS version
Major OS version
Entry point
127710
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths