Overview

overview

10

Static

static

10

c14e74f1d3...8e.exe

windows7-x64

10

c14e74f1d3...8e.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    c14e74f1d39c962a0015521019131b3df3d48ebb44996c83c1569d3ad189e68e.exe
  • Size 75KB
  • Sample240314-atfleagc79
  • SHA256 c14e74f1d39c962a0015521019131b3df3d48ebb44996c83c1569d3ad189e68e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
blacknethackedpersistencetrojan

Malware Config

Extracted

Family

  • blacknet

Botnet

  • HacKed

C2

  • http://dbhg.duckdns.org

Mutex

  • BN[ZGYKOnbZ-5872602]

Attributes
  • antivm

    true

  • elevate_uac

    false

  • install_name

    WindowsUpdate.exe

  • splitter

    |BN|

  • start_name

    35dcbc7eb742dd4f1edfbccf7826c724

  • startup

    true

  • usb_spread

    false

Targets

    • Target
      c14e74f1d39c962a0015521019131b3df3d48ebb44996c83c1569d3ad189e68e.exe
    • Size 75KB
    • SHA256 c14e74f1d39c962a0015521019131b3df3d48ebb44996c83c1569d3ad189e68e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    blacknetpersistencetrojan

    • BlackNET

      BlackNET is an open source remote access tool written in VB.NET.

      trojanblacknet

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks