Overview

overview

10

Static

static

10

2f56180119...19.exe

windows7_x64

10

2f56180119...19.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe
  • Size 116KB
  • Sample220512-ykawkahgg3
  • SHA256 2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cn32mxblacknet

Malware Config

Extracted

Family

  • blacknet

Version

  • v3.7.0 Public

Botnet

  • CN32mX

C2

  • http://theblogreader-blog.wtf/panel/

Mutex

  • BN[64edd583e1917b9564d89cb984d089c0]

Attributes
  • antivm

    false

  • elevate_uac

    false

  • install_name

    WindowsUpdate.exe

  • splitter

    |BN|

  • start_name

    e162b1333458a713bc6916cc8ac4110c

  • startup

    true

  • usb_spread

    false

Signatures

  • BlackNET Payload 1 IoCs
  • Blacknet family
    blacknet
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

File Explorer

  • 2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe
    .exe 116KB

2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe

  • IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
  • SHA256 2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19
  • MD5 SHA1 SHA512 SSDEEP
windowsx86

  • BlackNET Payload

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Minor OS version
Major OS version
Entry point
113134
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths