Overview

overview

10

Static

static

10

WinlockerB...v5.exe

windows7-x64

10

WinlockerB...v5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WinlockerBuilderv5.exe

  • Size

    11.0MB

  • Sample

    241010-takkssyfjr

  • MD5

    5891817266ffedc10d4a84a3bd483239

  • SHA1

    b59d365a91b50ec55ccc1c1b2a70cbf858382aa3

  • SHA256

    51c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465

  • SHA512

    517c5d785f069ce566c1d89fcc998968a5cdfc6d85bcc7e42cc2e720b4be9b543065cc1c7967635948595fdbb4af3fc7714c8b90aa6035953bca40cba7272c23

  • SSDEEP

    49152:VEdISABBHJtTPSfon8ElC8exQ5ekWtoy/WnwTua+V1ISCezf/rs6kLrHKOWHWq6r:VEd9

Score
10/10
blacknetdarkcometbotguest16discoverypersistencerattrojan

Malware Config

Extracted

Family

blacknet

Version

v3.6.0 Public

Botnet

Bot

C2

http://f0483357.xsph.ru/

Mutex

BN[PHfunXGI-6235724]

Attributes
  • antivm

    true

  • elevate_uac

    false

  • install_name

    jusched.exe

  • splitter

    |BN|

  • start_name

    a5b002eacf54590ec8401ff6d3f920ee

  • startup

    true

  • usb_spread

    true

Extracted

Family

darkcomet

Botnet

Guest16

C2

gameservice.ddns.net:4320

Mutex

DC_MUTEX-WBUNVXD

Attributes
  • InstallPath

    AudioDriver\taskhost.exe

  • gencode

    EWSsWwgyJrUD

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    AudioDriver

Targets

    • Target

      WinlockerBuilderv5.exe

    • Size

      11.0MB

    • MD5

      5891817266ffedc10d4a84a3bd483239

    • SHA1

      b59d365a91b50ec55ccc1c1b2a70cbf858382aa3

    • SHA256

      51c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465

    • SHA512

      517c5d785f069ce566c1d89fcc998968a5cdfc6d85bcc7e42cc2e720b4be9b543065cc1c7967635948595fdbb4af3fc7714c8b90aa6035953bca40cba7272c23

    • SSDEEP

      49152:VEdISABBHJtTPSfon8ElC8exQ5ekWtoy/WnwTua+V1ISCezf/rs6kLrHKOWHWq6r:VEd9

    Score
    10/10
    blacknettrojandarkcometguest16discoverypersistencerat

    • BlackNET

      BlackNET is an open source remote access tool written in VB.NET.

      trojanblacknet

    • BlackNET payload

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks