General

  • Target

    70c14e56f7a3896c5f201f72fe572364bbd575dd607a67aa954220803102c8b6N

  • Size

    80KB

  • MD5

    bdba09048a1d0ffa6cd6a0406cf60b90

  • SHA1

    82e48cc2ebbcfaa292f44206068004e80adad394

  • SHA256

    70c14e56f7a3896c5f201f72fe572364bbd575dd607a67aa954220803102c8b6

  • SHA512

    985f2a459324c960eaac1d23741f47cedd99702bd1ed0d0eeec89903cd0d9d67895ef8903148fc762eca4f9cc0e24880e4b550061f8426cebad4962ca5590f8f

  • SSDEEP

    1536:QPvK/3zvzVJJicVLhilofsh0jzJxuOmb54vHTL+lf:Qi5ikFSofxzVmb5uHv+lf

Score
10/10

Malware Config

Extracted

Family

blacknet

Botnet

HacKed

C2

https://www.gunnylaumienphi2017.com/

Mutex

BN[qNldZlCR-8683277]

Attributes
  • antivm

    true

  • elevate_uac

    false

  • install_name

    WindowsUpdate.exe

  • splitter

    |BN|

  • start_name

    cde2f914e4cce7f13b2c1cec7b6da970

  • startup

    false

  • usb_spread

    true

Signatures

  • BlackNET payload 1 IoCs
  • Blacknet family
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 70c14e56f7a3896c5f201f72fe572364bbd575dd607a67aa954220803102c8b6N
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.