General

  • Target

    ca39cfc98b39b6370eaf2a70259c180fc3a19e3b862fde1da9c553ea03339e6fN

  • Size

    83KB

  • MD5

    cd2f9135225135478191cafb875deac0

  • SHA1

    d6a564d2c76def46ef1bf2240d384e5a10f74cfb

  • SHA256

    ca39cfc98b39b6370eaf2a70259c180fc3a19e3b862fde1da9c553ea03339e6f

  • SHA512

    e7747564310fda4c3b8e52f5f0919413ddfbdd39e5c87cd59c5b0f81ca3fc051d827e52d3369b23a2433ba9cafd2b545d19e3caf308832fdb09d3b5967fcc43b

  • SSDEEP

    1536:PwPvK/3zvzVohd9BRiF/JUUjzJxuOmb54vHTLazm7/:PwiGDjiVHzVmb5uHvmm7/

Score
10/10

Malware Config

Extracted

Family

blacknet

Botnet

HacKed

C2

https://www.gunnylaumienphi2017.com/

Mutex

BN[UpPHDOfu-4248733]

Attributes
  • antivm

    true

  • elevate_uac

    false

  • install_name

    WindowsUpdate.exe

  • splitter

    |BN|

  • start_name

    cde2f914e4cce7f13b2c1cec7b6da970

  • startup

    false

  • usb_spread

    true

Signatures

  • BlackNET payload 1 IoCs
  • Blacknet family
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ca39cfc98b39b6370eaf2a70259c180fc3a19e3b862fde1da9c553ea03339e6fN
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.