General
-
Target
51c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465
-
Size
11.0MB
-
Sample
221112-h6sqhahd8s
-
MD5
5891817266ffedc10d4a84a3bd483239
-
SHA1
b59d365a91b50ec55ccc1c1b2a70cbf858382aa3
-
SHA256
51c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465
-
SHA512
517c5d785f069ce566c1d89fcc998968a5cdfc6d85bcc7e42cc2e720b4be9b543065cc1c7967635948595fdbb4af3fc7714c8b90aa6035953bca40cba7272c23
-
SSDEEP
49152:VEdISABBHJtTPSfon8ElC8exQ5ekWtoy/WnwTua+V1ISCezf/rs6kLrHKOWHWq6r:VEd9
Malware Config
Extracted
blacknet
v3.6.0 Public
Bot
http://f0483357.xsph.ru/
BN[PHfunXGI-6235724]
-
antivm
true
-
elevate_uac
false
-
install_name
jusched.exe
-
splitter
|BN|
-
start_name
a5b002eacf54590ec8401ff6d3f920ee
-
startup
true
-
usb_spread
true
Extracted
darkcomet
Guest16
gameservice.ddns.net:4320
DC_MUTEX-WBUNVXD
-
InstallPath
AudioDriver\taskhost.exe
-
gencode
EWSsWwgyJrUD
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
AudioDriver
Targets
-
-
Target
51c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465
-
Size
11.0MB
-
MD5
5891817266ffedc10d4a84a3bd483239
-
SHA1
b59d365a91b50ec55ccc1c1b2a70cbf858382aa3
-
SHA256
51c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465
-
SHA512
517c5d785f069ce566c1d89fcc998968a5cdfc6d85bcc7e42cc2e720b4be9b543065cc1c7967635948595fdbb4af3fc7714c8b90aa6035953bca40cba7272c23
-
SSDEEP
49152:VEdISABBHJtTPSfon8ElC8exQ5ekWtoy/WnwTua+V1ISCezf/rs6kLrHKOWHWq6r:VEd9
-
BlackNET payload
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-