General
-
Target
c138d8e3110237ad4ed5dba3308a2e8a4eb685f84a55043354554b1127776671
-
Size
179KB
-
Sample
221130-tyzdvsff54
-
MD5
c89be917eb11b5f09561177b4cfddff5
-
SHA1
61f7e9a65430c732bb145864fb5ea40fddbde35e
-
SHA256
c138d8e3110237ad4ed5dba3308a2e8a4eb685f84a55043354554b1127776671
-
SHA512
6717283fd645873a042f63ea95ba01455d91a046317c0011a387bbfd352b69e71a53cb15811d0ff3ac2c7682102961da68c6fc7aa729a8fc2196e9af139ce5af
-
SSDEEP
3072:zobMNvy29G/P/XP3ue33nev2W33PXPmG+ePu23PfmmO3XePmmPm3PeP3uPvu/Ovi:zobwhVi2nh3HETytaoRFYBiXB
Static task
static1
Behavioral task
behavioral1
Sample
c138d8e3110237ad4ed5dba3308a2e8a4eb685f84a55043354554b1127776671.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c138d8e3110237ad4ed5dba3308a2e8a4eb685f84a55043354554b1127776671.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
blacknet
v3.7.0 Public
HacKed
http://194.33.45.112
BN[]
-
antivm
false
-
elevate_uac
false
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
e162b1333458a713bc6916cc8ac4110c
-
startup
false
-
usb_spread
false
Targets
-
-
Target
c138d8e3110237ad4ed5dba3308a2e8a4eb685f84a55043354554b1127776671
-
Size
179KB
-
MD5
c89be917eb11b5f09561177b4cfddff5
-
SHA1
61f7e9a65430c732bb145864fb5ea40fddbde35e
-
SHA256
c138d8e3110237ad4ed5dba3308a2e8a4eb685f84a55043354554b1127776671
-
SHA512
6717283fd645873a042f63ea95ba01455d91a046317c0011a387bbfd352b69e71a53cb15811d0ff3ac2c7682102961da68c6fc7aa729a8fc2196e9af139ce5af
-
SSDEEP
3072:zobMNvy29G/P/XP3ue33nev2W33PXPmG+ePu23PfmmO3XePmmPm3PeP3uPvu/Ovi:zobwhVi2nh3HETytaoRFYBiXB
-
BlackNET payload
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Deletes itself
-
Drops startup file
-
Suspicious use of SetThreadContext
-