General

  • Target

    26b7b2be0ccfa6d1d01bd6fded59ca19ba9bf9acd5602ffb25ffdf7f37fb6d72N

  • Size

    80KB

  • MD5

    36ffc99d00b52c1b2c73447e4526dc10

  • SHA1

    c9adf0f928b2eedd092408e1d230fbca774956f3

  • SHA256

    26b7b2be0ccfa6d1d01bd6fded59ca19ba9bf9acd5602ffb25ffdf7f37fb6d72

  • SHA512

    0ee5eb6c8606ac89193d071c4574b2d80f6b5a7eb84bc7989e8e2959ffdd68511e2e19c679d66b438d36719c5bb5b1e77bd81f5fc8531ed9a028dfbcb60c96ee

  • SSDEEP

    1536:QPvK/3zvzVJJicVLhilofsh3jzJxuOmb54vHTL+lf:Qi5ikFSof0zVmb5uHv+lf

Score
10/10

Malware Config

Extracted

Family

blacknet

Botnet

HacKed

C2

https://www.gunnylaumienphi2017.com/

Mutex

BN[qNldZlCR-8683277]

Attributes
  • antivm

    true

  • elevate_uac

    false

  • install_name

    WindowsUpdate.exe

  • splitter

    |BN|

  • start_name

    cde2f914e4cce7f13b2c1cec7b6da970

  • startup

    false

  • usb_spread

    true

Signatures

  • BlackNET payload 1 IoCs
  • Blacknet family
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 26b7b2be0ccfa6d1d01bd6fded59ca19ba9bf9acd5602ffb25ffdf7f37fb6d72N
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.