Overview

overview

10

Static

static

10

acea5fb0f0...d9.exe

windows7-x64

10

acea5fb0f0...d9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    acea5fb0f0dd0ad6e33cedbaed6fdbd9

  • Size

    45KB

  • Sample

    240228-1g6vyaee92

  • MD5

    acea5fb0f0dd0ad6e33cedbaed6fdbd9

  • SHA1

    b8c8d170b78ba0f117fc13ddb1ace03efd2a8b0b

  • SHA256

    76844c2401ac24b85e662d65f5007dc193e81df6c9493963c8e09de55f98cdfa

  • SHA512

    adb12002574276b0357e5971d3fd9c7a9e57a3d34800693ce5f357d09f548051819376f669a1727db363566aa9574b11edb0fec89e55ac5c7df88275ac0f179b

  • SSDEEP

    768:RcQQj5JBXsahUBZGa1jRY+JPPtTVv04Ap+aTV5fbfts6hs/a0fC:lQj5TXgGapGoVVvB43jbfts6h70fC

Score
10/10
blacknet83pe2qtrojan

Malware Config

Extracted

Family

blacknet

Version

v3.7.0 Public

Botnet

83pE2q

C2

http://100.26.17.80

Mutex

BN[e3f2e5808feda59aa28196]

Attributes
  • antivm

    false

  • elevate_uac

    false

  • install_name

    WindowsUpdate.exe

  • splitter

    |BN|

  • start_name

    a1c8373d971dfcd2057c69646c6c3502

  • startup

    false

  • usb_spread

    false

Targets

    • Target

      acea5fb0f0dd0ad6e33cedbaed6fdbd9

    • Size

      45KB

    • MD5

      acea5fb0f0dd0ad6e33cedbaed6fdbd9

    • SHA1

      b8c8d170b78ba0f117fc13ddb1ace03efd2a8b0b

    • SHA256

      76844c2401ac24b85e662d65f5007dc193e81df6c9493963c8e09de55f98cdfa

    • SHA512

      adb12002574276b0357e5971d3fd9c7a9e57a3d34800693ce5f357d09f548051819376f669a1727db363566aa9574b11edb0fec89e55ac5c7df88275ac0f179b

    • SSDEEP

      768:RcQQj5JBXsahUBZGa1jRY+JPPtTVv04Ap+aTV5fbfts6hs/a0fC:lQj5TXgGapGoVVvB43jbfts6h70fC

    Score
    10/10
    blacknet83pe2qtrojan

    • BlackNET

      BlackNET is an open source remote access tool written in VB.NET.

      trojanblacknet

    • BlackNET payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks