General
-
Target
Client.bin
-
Size
81KB
-
MD5
d504f7de6fc5459ee783b868766c1c4b
-
SHA1
f31c98177ddfed34d1aa4bbb15b4dd22a887bf7a
-
SHA256
753af27307876aa774a1f942184312dd73fa8f85331a5bc8c0f35dede2a5702a
-
SHA512
9c42c754c70d4b82f120d380faf615e8ff118668ffd56e5fdc0218224be1a22c91f402f656fe625092f6d6070131b2e9c399e8e430eac2a944376459ef62786e
-
SSDEEP
1536:JZuhD5z28TCRZyDeK0uKsA1HdCbv42jYLe81d:5OeKKJwbvTj6eud
Score
10/10
Malware Config
Extracted
Family
blacknet
Version
v3.5 Public
Botnet
bot
C2
http://52.34.77.168:54948
Mutex
BN[mIgYVgxM-7572066]
Attributes
-
antivm
false
-
elevate_uac
false
-
install_name
svchost.exe
-
splitter
|BN|
-
start_name
14247ae8e9bdf8a07859c46cc6c701e5
-
startup
true
-
usb_spread
true
Signatures
-
BlackNET payload 1 IoCs
-
Blacknet family
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Files
-
Client.bin
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections