General
-
Target
d0df03735eb50a56a91ed7788869cc9cee7e74be534020875b65f591e51aab19N
-
Size
80KB
-
MD5
3f4e8158b0a9e0b499a71da3d77dcf60
-
SHA1
ed37aad513db7d3a2598a42a2094f568b2b72b15
-
SHA256
d0df03735eb50a56a91ed7788869cc9cee7e74be534020875b65f591e51aab19
-
SHA512
69601cf8695f1d58453bf5b3126900bf9b7d5f8fb6e30b41f1790896ed80c640d83152821f0d0fa909bd42515850eedee47e5e995b9673fe40f81624f58a073a
-
SSDEEP
1536:QPvK/3zvzVJJicVLhilofshQjzJxuOmb54vHTL+lf:Qi5ikFSofdzVmb5uHv+lf
Score
10/10
Malware Config
Extracted
Family
blacknet
Botnet
HacKed
C2
https://www.gunnylaumienphi2017.com/
Mutex
BN[qNldZlCR-8683277]
Attributes
-
antivm
true
-
elevate_uac
false
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
cde2f914e4cce7f13b2c1cec7b6da970
-
startup
false
-
usb_spread
true
Signatures
-
BlackNET payload 1 IoCs
-
Blacknet family
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
d0df03735eb50a56a91ed7788869cc9cee7e74be534020875b65f591e51aab19N
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections