blacknet | f38de4913b8110f971939219bab3d06d0a5682c0a9649b7f344af83429958e0c

Analysis

max time kernel
184s
max time network
243s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
05-12-2024 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Botnets_PACK.rar
Size

27.5MB
MD5

edaebf5c06f81cbe6123a820761dd217
SHA1

e4ce7f4a9d61548e91160647c7d7df62315b3441
SHA256

f38de4913b8110f971939219bab3d06d0a5682c0a9649b7f344af83429958e0c
SHA512

b0d984be5ebc6642e1c7191d42cfec2fc35dcfce031f1c6568dccdd0413fab18ad64abd6337075a37023f6ed514ea38c6b561375d065dbde6cbcb8fe1c8388ee
SSDEEP

786432:U5WlRiyrkogffaoyq0RXDPTCyK9pDw5sz+WP/:aGRgLAM9pDw5szVP/

Score

10^/10

blacknet smokeloader backdoor discovery execution persistence trojan upx

Malware Config

Extracted

Family

smokeloader

Version

2017

http://dogewareservice.ru/

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0002000000025cc3-2271.dat	family_blacknet

Blacknet family
blacknet

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/files/0x0002000000025cc3-2271.dat	disable_win_def

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4720	powershell.exe
3120	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Startup.lnk	Launcher.exe

Executes dropped EXE 29 IoCs

pid	Process
3296	pandora.exe
2948	Launcher.exe
4472	sxs.exe
4276	antivar.exe
108	Windows Services.exe
132	Secure System Shell.exe
2448	Runtime Explorer.exe
4980	pandora.exe
2308	Launcher.exe
4112	sxs.exe
1272	Launcher.exe
4544	sxs.exe
2664	sxs.exe
3420	smokeloader.exe
3352	Launcher.exe
3296	CoreShell.exe
4552	Launcher.exe
1904	CoreShell.exe
5060	smokeloader.exe
3424	Launcher.exe
4764	CoreShell.exe
2804	PonyBuilder.exe
1416	Launcher.exe
5100	WPFToolkit.exe
4920	BlackNET Builder.exe
1520	Launcher.exe
768	RESOURCES.exe
3736	watcher.exe
1912	stub.exe

Loads dropped DLL 16 IoCs

pid	Process
2948	Launcher.exe
2948	Launcher.exe
2308	Launcher.exe
2308	Launcher.exe
1272	Launcher.exe
1272	Launcher.exe
3352	Launcher.exe
3352	Launcher.exe
4552	Launcher.exe
4552	Launcher.exe
3424	Launcher.exe
3424	Launcher.exe
1416	Launcher.exe
1416	Launcher.exe
1520	Launcher.exe
1520	Launcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Runtime Explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Runtime Explorer.exe\""	Runtime Explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Runtime Explorer = "C:\\Windows\\IMF\\\\Windows Services.exe"	Launcher.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
21	raw.githubusercontent.com

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	CoreShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	CoreShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	CoreShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	CoreShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	CoreShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	CoreShell.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\antivar.exe	sxs.exe
File opened for modification	C:\Windows\SysWOW64\antivar.exe	sxs.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\sLT.exf	antivar.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001900000002af40-1963.dat	upx
behavioral1/memory/5100-1966-0x0000000000400000-0x0000000000826000-memory.dmp	upx
behavioral1/memory/5100-1975-0x0000000000400000-0x0000000000826000-memory.dmp	upx
behavioral1/memory/5100-1990-0x0000000000400000-0x0000000000826000-memory.dmp	upx
behavioral1/memory/5100-1992-0x0000000000400000-0x0000000000826000-memory.dmp	upx
behavioral1/memory/5100-2115-0x0000000000400000-0x0000000000826000-memory.dmp	upx
behavioral1/memory/5100-2238-0x0000000000400000-0x0000000000826000-memory.dmp	upx

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\IMF\Runtime Explorer.exe.tmp	Launcher.exe
File created	C:\Windows\IMF\Secure System Shell.exe.tmp	Launcher.exe
File opened for modification	C:\Windows\IMF\Secure System Shell.exe	Launcher.exe
File created	C:\Windows\IMF\LICENCE.zip	Launcher.exe
File created	C:\Windows\IMF\LICENCE.dat	Launcher.exe
File created	C:\Windows\IMF\Windows Services.exe.tmp	Launcher.exe
File opened for modification	C:\Windows\IMF\Windows Services.exe	Launcher.exe
File opened for modification	C:\Windows\IMF\LICENCE.zip	Launcher.exe
File opened for modification	C:\Windows\IMF\Runtime Explorer.exe	Launcher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3372	4200	WerFault.exe	105
864	4900	WerFault.exe	115

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PonyBuilder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runtime Explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smokeloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smokeloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Secure System Shell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WPFToolkit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pandora.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	antivar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pandora.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlackNET Builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2948	Launcher.exe
4720	powershell.exe
4720	powershell.exe
108	Windows Services.exe
108	Windows Services.exe
108	Windows Services.exe
108	Windows Services.exe
3120	powershell.exe
132	Secure System Shell.exe
3120	powershell.exe
2308	Launcher.exe
1272	Launcher.exe
3352	Launcher.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe
3296	CoreShell.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
3296	CoreShell.exe
3296	CoreShell.exe
1904	CoreShell.exe
1904	CoreShell.exe
4764	CoreShell.exe
4764	CoreShell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeRestorePrivilege	4768	7zFM.exe
Token: 35	4768	7zFM.exe
Token: SeSecurityPrivilege	4768	7zFM.exe
Token: SeDebugPrivilege	2948	Launcher.exe
Token: SeDebugPrivilege	4720	powershell.exe
Token: SeDebugPrivilege	108	Windows Services.exe
Token: SeDebugPrivilege	3120	powershell.exe
Token: SeDebugPrivilege	132	Secure System Shell.exe
Token: SeDebugPrivilege	2308	Launcher.exe
Token: SeDebugPrivilege	1272	Launcher.exe
Token: SeDebugPrivilege	3352	Launcher.exe
Token: SeDebugPrivilege	4552	Launcher.exe
Token: SeDebugPrivilege	3424	Launcher.exe
Token: SeDebugPrivilege	1416	Launcher.exe
Token: SeDebugPrivilege	1520	Launcher.exe
Token: SeDebugPrivilege	768	RESOURCES.exe
Token: SeDebugPrivilege	3736	watcher.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4768	7zFM.exe
4768	7zFM.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2448	Runtime Explorer.exe
1852	OpenWith.exe
5100	WPFToolkit.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 2948	3296	pandora.exe	83
PID 3296 wrote to memory of 2948	3296	pandora.exe	83
PID 3296 wrote to memory of 2948	3296	pandora.exe	83
PID 2948 wrote to memory of 4720	2948	Launcher.exe	84
PID 2948 wrote to memory of 4720	2948	Launcher.exe	84
PID 2948 wrote to memory of 4720	2948	Launcher.exe	84
PID 3296 wrote to memory of 4472	3296	pandora.exe	86
PID 3296 wrote to memory of 4472	3296	pandora.exe	86
PID 3296 wrote to memory of 4472	3296	pandora.exe	86
PID 2948 wrote to memory of 108	2948	Launcher.exe	89
PID 2948 wrote to memory of 108	2948	Launcher.exe	89
PID 2948 wrote to memory of 108	2948	Launcher.exe	89
PID 108 wrote to memory of 132	108	Windows Services.exe	90
PID 108 wrote to memory of 132	108	Windows Services.exe	90
PID 108 wrote to memory of 132	108	Windows Services.exe	90
PID 108 wrote to memory of 2448	108	Windows Services.exe	91
PID 108 wrote to memory of 2448	108	Windows Services.exe	91
PID 108 wrote to memory of 2448	108	Windows Services.exe	91
PID 2448 wrote to memory of 3120	2448	Runtime Explorer.exe	92
PID 2448 wrote to memory of 3120	2448	Runtime Explorer.exe	92
PID 2448 wrote to memory of 3120	2448	Runtime Explorer.exe	92
PID 4980 wrote to memory of 2308	4980	pandora.exe	96
PID 4980 wrote to memory of 2308	4980	pandora.exe	96
PID 4980 wrote to memory of 2308	4980	pandora.exe	96
PID 4980 wrote to memory of 4112	4980	pandora.exe	97
PID 4980 wrote to memory of 4112	4980	pandora.exe	97
PID 4980 wrote to memory of 4112	4980	pandora.exe	97
PID 3420 wrote to memory of 3352	3420	smokeloader.exe	103
PID 3420 wrote to memory of 3352	3420	smokeloader.exe	103
PID 3420 wrote to memory of 3352	3420	smokeloader.exe	103
PID 3420 wrote to memory of 3296	3420	smokeloader.exe	104
PID 3420 wrote to memory of 3296	3420	smokeloader.exe	104
PID 3420 wrote to memory of 3296	3420	smokeloader.exe	104
PID 3296 wrote to memory of 4200	3296	CoreShell.exe	105
PID 3296 wrote to memory of 4200	3296	CoreShell.exe	105
PID 3296 wrote to memory of 4200	3296	CoreShell.exe	105
PID 5060 wrote to memory of 3424	5060	smokeloader.exe	112
PID 5060 wrote to memory of 3424	5060	smokeloader.exe	112
PID 5060 wrote to memory of 3424	5060	smokeloader.exe	112
PID 5060 wrote to memory of 4764	5060	smokeloader.exe	113
PID 5060 wrote to memory of 4764	5060	smokeloader.exe	113
PID 5060 wrote to memory of 4764	5060	smokeloader.exe	113
PID 1904 wrote to memory of 4900	1904	CoreShell.exe	115
PID 1904 wrote to memory of 4900	1904	CoreShell.exe	115
PID 1904 wrote to memory of 4900	1904	CoreShell.exe	115
PID 2804 wrote to memory of 1416	2804	PonyBuilder.exe	116
PID 2804 wrote to memory of 1416	2804	PonyBuilder.exe	116
PID 2804 wrote to memory of 1416	2804	PonyBuilder.exe	116
PID 2804 wrote to memory of 5100	2804	PonyBuilder.exe	117
PID 2804 wrote to memory of 5100	2804	PonyBuilder.exe	117
PID 2804 wrote to memory of 5100	2804	PonyBuilder.exe	117
PID 4764 wrote to memory of 940	4764	CoreShell.exe	118
PID 4764 wrote to memory of 940	4764	CoreShell.exe	118
PID 4764 wrote to memory of 940	4764	CoreShell.exe	118
PID 4920 wrote to memory of 1520	4920	BlackNET Builder.exe	124
PID 4920 wrote to memory of 1520	4920	BlackNET Builder.exe	124
PID 4920 wrote to memory of 1520	4920	BlackNET Builder.exe	124
PID 4920 wrote to memory of 768	4920	BlackNET Builder.exe	125
PID 4920 wrote to memory of 768	4920	BlackNET Builder.exe	125
PID 3736 wrote to memory of 1912	3736	watcher.exe	127
PID 3736 wrote to memory of 1912	3736	watcher.exe	127

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Botnets_PACK.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4768

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4776

C:\Users\Admin\Desktop\Botnets PACK\Pandora\pandora.exe
"C:\Users\Admin\Desktop\Botnets PACK\Pandora\pandora.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Users\Admin\Desktop\Botnets PACK\Pandora\xpinstal\Launcher.exe
  "C:\Users\Admin\Desktop\Botnets PACK\Pandora\xpinstal\Launcher.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4720
- - C:\Windows\IMF\Windows Services.exe
    "C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:108
  - - C:\Windows\IMF\Secure System Shell.exe
      "C:\Windows\IMF\Secure System Shell.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:132
  - - C:\Windows\IMF\Runtime Explorer.exe
      "C:\Windows\IMF\Runtime Explorer.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2448
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Users\Admin\AppData\Roaming\
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3120
- C:\Users\Admin\Desktop\Botnets PACK\Pandora\xpinstal\sxs.exe
  "C:\Users\Admin\Desktop\Botnets PACK\Pandora\xpinstal\sxs.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4472

C:\Windows\SysWOW64\antivar.exe
C:\Windows\SysWOW64\antivar.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4276

C:\Users\Admin\Desktop\Botnets PACK\Pandora\pandora.exe
"C:\Users\Admin\Desktop\Botnets PACK\Pandora\pandora.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Users\Admin\Desktop\Botnets PACK\Pandora\xpinstal\Launcher.exe
  "C:\Users\Admin\Desktop\Botnets PACK\Pandora\xpinstal\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2308
- C:\Users\Admin\Desktop\Botnets PACK\Pandora\xpinstal\sxs.exe
  "C:\Users\Admin\Desktop\Botnets PACK\Pandora\xpinstal\sxs.exe"
  2⤵
  - Executes dropped EXE
  PID:4112

C:\Users\Admin\Desktop\Botnets PACK\Pandora\xpinstal\Launcher.exe
"C:\Users\Admin\Desktop\Botnets PACK\Pandora\xpinstal\Launcher.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1272

C:\Users\Admin\Desktop\Botnets PACK\Pandora\xpinstal\sxs.exe
"C:\Users\Admin\Desktop\Botnets PACK\Pandora\xpinstal\sxs.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4544

C:\Users\Admin\Desktop\Botnets PACK\Pandora\xpinstal\sxs.exe
"C:\Users\Admin\Desktop\Botnets PACK\Pandora\xpinstal\sxs.exe"
1⤵
- Executes dropped EXE
PID:2664

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1852

C:\Users\Admin\Desktop\Botnets PACK\Smoke Loader Original Stub\smokeloader.exe
"C:\Users\Admin\Desktop\Botnets PACK\Smoke Loader Original Stub\smokeloader.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Users\Admin\Desktop\Botnets PACK\Smoke Loader Original Stub\nssdbm3\Launcher.exe
  "C:\Users\Admin\Desktop\Botnets PACK\Smoke Loader Original Stub\nssdbm3\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3352
- C:\Users\Admin\Desktop\Botnets PACK\Smoke Loader Original Stub\nssdbm3\CoreShell.exe
  "C:\Users\Admin\Desktop\Botnets PACK\Smoke Loader Original Stub\nssdbm3\CoreShell.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4200
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 1028
      4⤵
      Program crash
      PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4200 -ip 4200
1⤵
PID:2848

C:\Users\Admin\Desktop\Botnets PACK\Smoke Loader Original Stub\nssdbm3\Launcher.exe
"C:\Users\Admin\Desktop\Botnets PACK\Smoke Loader Original Stub\nssdbm3\Launcher.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Users\Admin\Desktop\Botnets PACK\Smoke Loader Original Stub\nssdbm3\CoreShell.exe
"C:\Users\Admin\Desktop\Botnets PACK\Smoke Loader Original Stub\nssdbm3\CoreShell.exe"
1⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 1276
    3⤵
    - Program crash
    PID:864

C:\Users\Admin\Desktop\Botnets PACK\Smoke Loader Original Stub\smokeloader.exe
"C:\Users\Admin\Desktop\Botnets PACK\Smoke Loader Original Stub\smokeloader.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Users\Admin\Desktop\Botnets PACK\Smoke Loader Original Stub\nssdbm3\Launcher.exe
  "C:\Users\Admin\Desktop\Botnets PACK\Smoke Loader Original Stub\nssdbm3\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3424
- C:\Users\Admin\Desktop\Botnets PACK\Smoke Loader Original Stub\nssdbm3\CoreShell.exe
  "C:\Users\Admin\Desktop\Botnets PACK\Smoke Loader Original Stub\nssdbm3\CoreShell.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:940

C:\Users\Admin\Desktop\Botnets PACK\Pony 1.9\PonyBuilder.exe
"C:\Users\Admin\Desktop\Botnets PACK\Pony 1.9\PonyBuilder.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Users\Admin\Desktop\Botnets PACK\Pony 1.9\sys\Launcher.exe
  "C:\Users\Admin\Desktop\Botnets PACK\Pony 1.9\sys\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1416
- C:\Users\Admin\Desktop\Botnets PACK\Pony 1.9\sys\WPFToolkit.exe
  "C:\Users\Admin\Desktop\Botnets PACK\Pony 1.9\sys\WPFToolkit.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4900 -ip 4900
1⤵
PID:4960

C:\Users\Admin\Desktop\Botnets PACK\BlackNET - Compiled\BlackNET Builder.exe
"C:\Users\Admin\Desktop\Botnets PACK\BlackNET - Compiled\BlackNET Builder.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\Desktop\Botnets PACK\BlackNET - Compiled\aepic\Launcher.exe
  "C:\Users\Admin\Desktop\Botnets PACK\BlackNET - Compiled\aepic\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- C:\Users\Admin\Desktop\Botnets PACK\BlackNET - Compiled\aepic\RESOURCES.exe
  "C:\Users\Admin\Desktop\Botnets PACK\BlackNET - Compiled\aepic\RESOURCES.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:768

C:\Users\Admin\Desktop\Botnets PACK\BlackNET - Compiled\watcher.exe
"C:\Users\Admin\Desktop\Botnets PACK\BlackNET - Compiled\watcher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Users\Admin\Desktop\Botnets PACK\BlackNET - Compiled\stub.exe
  "C:\Users\Admin\Desktop\Botnets PACK\BlackNET - Compiled\stub.exe"
  2⤵
  - Executes dropped EXE
  PID:1912

C:\Users\Admin\Desktop\Client.exe
"C:\Users\Admin\Desktop\Client.exe"
1⤵
PID:4668
- C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"
  2⤵
  PID:1204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7fff6bcbcc40,0x7fff6bcbcc4c,0x7fff6bcbcc58
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1736,i,10182299951385596944,9623835479094831039,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1728 /prefetch:2
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2056,i,10182299951385596944,9623835479094831039,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2200,i,10182299951385596944,9623835479094831039,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2164 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,10182299951385596944,9623835479094831039,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3152,i,10182299951385596944,9623835479094831039,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4384,i,10182299951385596944,9623835479094831039,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4408 /prefetch:1
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4604,i,10182299951385596944,9623835479094831039,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4776,i,10182299951385596944,9623835479094831039,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3676,i,10182299951385596944,9623835479094831039,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4348,i,10182299951385596944,9623835479094831039,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4572,i,10182299951385596944,9623835479094831039,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:1728

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2944

C:\Users\Admin\Desktop\Botnets PACK\BlackNET - Compiled\aepic\Launcher.exe
"C:\Users\Admin\Desktop\Botnets PACK\BlackNET - Compiled\aepic\Launcher.exe"
1⤵
PID:4100

C:\Users\Admin\Desktop\Botnets PACK\BlackNET - Compiled\aepic\watcher.exe
"C:\Users\Admin\Desktop\Botnets PACK\BlackNET - Compiled\aepic\watcher.exe"
1⤵
PID:4560

C:\Users\Admin\Desktop\Botnets PACK\BlackNET - Compiled\aepic\RESOURCES.exe
"C:\Users\Admin\Desktop\Botnets PACK\BlackNET - Compiled\aepic\RESOURCES.exe"
1⤵
PID:3264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
328855bff395a7352c0ec29631dfeef2

SHA1
687042a45b2b61fd6fe04aa7c5356800c4bd2f67

SHA256
f9ae15515aac34cf3251cac7759cd079920bf47bf65e75224c9b1eb7a8519102

SHA512
970a75ac5070bb0c50926882c92a8d385ae88a16dd2aab75e26a3894bdd01c6a5c557a5ec8c7140b064dcefbc97bf7bf1b3f3fb9fbf58c8fdd80eede1fa72b3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b9e928c05ffc296a30fb4ff09501fffa

SHA1
f76bd737270ad01312915636b7dc2b80dbd08442

SHA256
4cddf3e6d200e1450b1c23ba464a96d8aef6cf84710b2342fcb3365c35053ad5

SHA512
e386f36851a87ab6e2a0a85a437a6c5bc6f7d531b0c6e4b633490109030c05f674b896fe04ea0968236dedb5845088341e4c87c6edafd79a7e735012decc39b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
d9c4b28cb8f25a554ed0292f1b49f514

SHA1
62c2b40985ecaa6e434996e373c1f5f04d2002df

SHA256
98af9b903a95172793d870e95c93b824dbfed023adb27266548c94154f7d94aa

SHA512
7b874500d210e4ad37adb34191ecd4e3c21f7c66b5d85509ba622252a01277e4300504c5a5aa99eff097c71448b07ef3dfc6b99c7d24ac7b7148a64c8b152986

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
ebc9b012abcf7ef4c389e11820c0c0a5

SHA1
50eebfce1d5ca0cda49108d1a3782a9e4cbd37a9

SHA256
700cdf6c67c75a3d7a9f49701ad97e5e55b519f8707c8c05841a2ea35529c0ec

SHA512
d490bb8c2c013a17f7b640706405862822830a2ef4bd650226cf929f05271065b1f34993155629cfb436c23bc4379fd9c5b86feb49b7c068a67b68e0546882a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Launcher.exe.log

Filesize
1KB

MD5
86254e7829d7e589b36158ff7c4a81fe

SHA1
feec156a5f610ea4b7ad0cfeb102696f227d45c2

SHA256
4ee6cb3306075a294d8856310408c53a067420756b71542468295ce44a2044ca

SHA512
6d66535eb82c6a29603a43ea3a4c85299c7958c3db513b4119e6a05b386f12b8f6402eee4f4a272c893e644f8eb7f0b14025ce9e99017014574245f619f14347

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\pandora.exe.log

Filesize
1KB

MD5
28df963c88836df10a200a7f3ddcdaf2

SHA1
12c9058ad17a0a186021a145aad09fd32bb8fa2c

SHA256
d61f44cb34af871284be7ca4dec205a1bf8ca747b2efbdb84a14e7df0ae3e85f

SHA512
6c55ee17008aad1bec0abfd8ad48d5d86b3d371b62eed0418a1351ac1c747a1226fdb3edb46480d6da4bab9c7dab3a05bc8958cc7e83cfe00419afb7531cefff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d0c46cad6c0778401e21910bd6b56b70

SHA1
7be418951ea96326aca445b8dfe449b2bfa0dca6

SHA256
9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

SHA512
057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
e00a3477c0d29cd28334ab8933c26386

SHA1
a9f3e7ec4c97a65f1f50a99e8873f19cb01c32ee

SHA256
466d34c99f0320bfe72404c5edb443ac3f28b06be49da188b1ad125dab9a02e3

SHA512
c53492c25f9984e8361b91d4f069a7482054790acca49346361fbe757afa4b720d7a46a17a5bc52a92c25bc390afdee02f46a41dc9774cdda6a92de15dc13079

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE0A2DF387\Botnets PACK\BetaBotBuilder Leaked by Bull\npnul32\Ionic.Zip.dll

Filesize
480KB

MD5
f6933bf7cee0fd6c80cdf207ff15a523

SHA1
039eeb1169e1defe387c7d4ca4021bce9d11786d

SHA256
17bb0c9be45289a2be56a5f5a68ec9891d7792b886e0054bc86d57fe84d01c89

SHA512
88675512daa41e17ce4daf6ca764ccb17cd9633a7c2b7545875089cae60f6918909a947f3b1692d16ec5fa209e18e84bc0ff3594f72c3e677a6cca9f3a70b8d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE0A2DF387\Botnets PACK\BetaBotBuilder Leaked by Bull\npnul32\LICENCE.dat

Filesize
77KB

MD5
5180046f168dfd684b5bf268f5a0fa56

SHA1
ac8202ad5c94eb4d9e6227af92b5120e6d1b7ce7

SHA256
4139baa8beebcde4504c33bc88cf13b9ab9f32e4a054871ebeb82be6b84edc01

SHA512
04add8dc053c39a594e7889071b3fb9036fdc978b6f39f769c38b322e18a4ea6e05b6b66d97f0ac40c58f39120c791006a5b732da46ceba799e0db74afbed3e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE0A2DF387\Botnets PACK\BetaBotBuilder Leaked by Bull\npnul32\Launcher.exe

Filesize
53KB

MD5
c6d4c881112022eb30725978ecd7c6ec

SHA1
ba4f96dc374195d873b3eebdb28b633d9a1c5bf5

SHA256
0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32

SHA512
3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe

Filesize
83KB

MD5
a78ffc4975801b7b94a55878a8a023ee

SHA1
175f9ea8bb518dca27798e97af83527afadb710f

SHA256
e02d1d2ea6e9f81a88a0a9ad40ba34b4ee30053016bc2bb5c2d1d6bcd6e96f5d

SHA512
af691b3223a7a2e3ad42628231e5d40bfa58b6d29bc459235db6d63326c7a149d6b4662b705ab7e5c08828ce11490a65b7fadbd77d7d0acb2d6238c96435b7a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dpo3ql13.okr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2253712635-4068079004-3870069674-1000\49c1fc16268b1128f0a75bcc111d4dc8_8eddfaa5-5215-4a3e-9643-56d670a6027a

Filesize
2KB

MD5
8de91c4f830956990012f9fd1269e490

SHA1
5396852c5a98d586d3970638bebf52ac4d7da6b9

SHA256
4b1f314ed0d2dd0aedd922297f2b16cce1d5716a24469b72a9e17ea43bc40433

SHA512
4c0ef84683613edb6196a43e2da73c58203e080cdee1c4119ad6b3823db137fec0628eb7fa8f34a7da93aa142a13b001168959d59cb425ae858372b5d7f2d555

Download Submit
C:\Users\Admin\Desktop\Botnets PACK\BlackNET - Compiled\BlackNET Builder.exe

Filesize
176KB

MD5
4e548a7c6eab54dd088499693ec80de0

SHA1
14dc314730672cdcc0d149dbc394457a729f477d

SHA256
3eef584ad9c9cee94f1e5a9950baa4b9b68d628e6d3ad9e02b2eb53e88d9293b

SHA512
e0539f8a6fbdf621578c6365e87749b055c5d61a816a28cc6c77fe59bc7aaa2ceac9f86861df4c25f1c8600a408e8ae892886359b78cb15907153cdddec517a2

Download Submit
C:\Users\Admin\Desktop\Botnets PACK\Pandora\pandora.exe

Filesize
187KB

MD5
e7b87d16dbb2f2488800ba00ade5e005

SHA1
3fe6707350519d1a1c13543f7c9b4d0e4f325e0d

SHA256
632e1cb4120d214391fb5190de27053e4d7d2df945f9e87d9879ec003111c573

SHA512
9e6fa4c00a41d71457d9ac87d0d2e39462000918a4ae4bd028fb338e3027d2cf02ac6abf260bce52d875ebc2751985ffdb585f8d2d7ae9d7604e9b54d238824d

Download Submit
C:\Users\Admin\Desktop\Botnets PACK\Pandora\xpinstal\sxs.exe

Filesize
173KB

MD5
10640ef9fde79d019af1f2d2c5b404bf

SHA1
4df5f99315e13d7e25877175542ba6af739c5b18

SHA256
b32127f2a1c40cd48ccb77a3311c8f814f1ba8323cafa65429fbfa4acdd3e713

SHA512
a6a592319e432ebf14dbed851ba8ba924602a6b5673fe98b978e2bad09c640cdba86e3fab879b61780346108d64a94ab4ce005bff7c46db3315201b7b3d2ff63

Download Submit
C:\Users\Admin\Desktop\Botnets PACK\Pony 1.9\PonyBuilder.exe

Filesize
190KB

MD5
cf00a88af886bbbbbf6ab31e9e62b8fb

SHA1
c1f745b6bd6ca4da050be5012bfe79476ecced09

SHA256
34e320edbee6ac5513c520b799d86403679f324eab4ca8e00f313d6b61a6e715

SHA512
a0c74f2ca95164372ca51ee84e9189a2494f17adb79015505be3d33245d103605b03e4896b00930a64d51d4444db73658a57ef88bfee4e0010c5b308f72ce775

Download Submit
C:\Users\Admin\Desktop\Botnets PACK\Pony 1.9\sys\Pony.ini

Filesize
2KB

MD5
b4baef4826e950f77f990ec1a0f54da9

SHA1
edde62abfb99fcad9168039c0f6a1dfac1ca4a72

SHA256
c460af3223d5c316bc168694db1423ac80951e39f247381abb7c0da569e876ca

SHA512
3d8032f38708de5df4845065016cc0520147e0c6c5b2aac2008b6fc3951e2829ccd8edd3e52e9c827f745a1d1fadfbd3e8f15836062d702e2d11f04dc410ccc7

Download Submit
C:\Users\Admin\Desktop\Botnets PACK\Pony 1.9\sys\Pony.ini

Filesize
2KB

MD5
7eace74006609132c41e37ed0591b32c

SHA1
85322a55c4ec7bed2fef5cf64bc8b9d0a38383c0

SHA256
b57375572308eb4a93718ed9490d4be03698e08dd55aa8bdb3ac95e05836de31

SHA512
c4fcd6ef1b7c71edc5910a2021ba4e6f9aa4ad90150bbbb709b21f5cb2f1d40b11117c43208cfc904f03f1378f5693659edb64f72db6a8f66f76b21ad2317622

Download Submit
C:\Users\Admin\Desktop\Botnets PACK\Pony 1.9\sys\WPFToolkit.exe

Filesize
2.1MB

MD5
14723ffeebf824bb4f909558c6d4172e

SHA1
0a2df5ec2ab106af7c4b71e14bdc8892f0b8bd22

SHA256
f20b1ced29f3cf81aa561423363691b2cfc0c48903e0ea2689b230e65b175833

SHA512
31b654b4bdb564752866e090f40371b531279f20591a77b99b83d66023a64001a5fe2989a71d61d392ad2a0f59c29d48c4487d79fa4192573fc44a014fb0b51e

Download Submit
C:\Users\Admin\Desktop\Botnets PACK\Smoke Loader Original Stub\nssdbm3\CoreShell.exe

Filesize
13KB

MD5
75f6bb5d297c4ffbdff65cc5bbbdfb37

SHA1
0aa7c2e75f63c685d8d085fbafca3a91d297b683

SHA256
5eb4e7d954ad12e89c9c500f9894b76d08b7e53eb0f3f0b0e681d3bf11c4db51

SHA512
fdb38133304714e3e553b02df7a7bb62b9127c9c832390ffb1553f3523cdffd00611b29a4916f00bd6b79209fef5b0ca4e4c28192e5522880bbde231c00ca7df

Download Submit
C:\Users\Admin\Desktop\Botnets PACK\Smoke Loader Original Stub\smokeloader.exe

Filesize
227KB

MD5
c5eef97b1208860a67749d997ef6ee4e

SHA1
612a551d0500188646727ab0c449a8886a6bb540

SHA256
aeaf5634f6749e646b02d37d4fc1e5ad6cdae2cb26799cb46779917a17e41dc6

SHA512
f7674eacb5a65160036a0302842515ad17d377b2f8ca7a7cf75b75fcb79442ff79161f13b13364b75a78a45555d0172c736d11763586903ff57f12c06403bd70

Download Submit
C:\Windows\IMF\Runtime Explorer.exe

Filesize
152KB

MD5
03f5e0141f4519f0c5ac26ce0b036a0f

SHA1
4f7a2a230e7a194a898cc9f2d563ac8777fe99c0

SHA256
78a408c628e33e3332645f480ee7ce01b5dc24fc96cf16ffa0868d43f3d421ef

SHA512
86a68f040654006e06b51c5714e0d7168d0d1bef7f3c39843632068104f773f771d21be4bc251d712f3e915cd1058f89ad31d9e3f3d9e7cf6da6785cbf22d8d7

Download Submit
C:\Windows\IMF\Secure System Shell.exe

Filesize
45KB

MD5
7d0c7359e5b2daa5665d01afdc98cc00

SHA1
c3cc830c8ffd0f53f28d89dcd9f3426be87085cb

SHA256
f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809

SHA512
a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407

Download Submit
C:\Windows\IMF\Windows Services.exe

Filesize
46KB

MD5
ad0ce1302147fbdfecaec58480eb9cf9

SHA1
874efbc76e5f91bc1425a43ea19400340f98d42b

SHA256
2c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3

SHA512
adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53

Download Submit
memory/108-1837-0x0000000000A00000-0x0000000000A12000-memory.dmp

Filesize
72KB

Download
memory/132-1859-0x0000000000CD0000-0x0000000000CE2000-memory.dmp

Filesize
72KB

Download
memory/768-2245-0x0000000000E60000-0x0000000000F2A000-memory.dmp

Filesize
808KB

Download
memory/768-2257-0x000000001E4C0000-0x000000001E51A000-memory.dmp

Filesize
360KB

Download
memory/940-1969-0x00000000008E0000-0x0000000000D0C000-memory.dmp

Filesize
4.2MB

Download
memory/940-1970-0x00000000008E0000-0x0000000000D0C000-memory.dmp

Filesize
4.2MB

Download
memory/940-1986-0x0000000000640000-0x000000000064A000-memory.dmp

Filesize
40KB

Download
memory/940-1971-0x0000000000640000-0x000000000064A000-memory.dmp

Filesize
40KB

Download
memory/1904-1940-0x0000000000630000-0x000000000063A000-memory.dmp

Filesize
40KB

Download
memory/1904-1980-0x0000000000630000-0x000000000063A000-memory.dmp

Filesize
40KB

Download
memory/1912-2253-0x000000001F390000-0x000000001F3F2000-memory.dmp

Filesize
392KB

Download
memory/2664-1906-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2804-1953-0x0000000000450000-0x0000000000486000-memory.dmp

Filesize
216KB

Download
memory/2948-1770-0x0000000000190000-0x00000000001A4000-memory.dmp

Filesize
80KB

Download
memory/2948-1822-0x0000000005E20000-0x0000000005E3E000-memory.dmp

Filesize
120KB

Download
memory/2948-1821-0x0000000005E40000-0x0000000005EB6000-memory.dmp

Filesize
472KB

Download
memory/2948-1774-0x00000000061E0000-0x000000000625E000-memory.dmp

Filesize
504KB

Download
memory/3120-1878-0x000000006F450000-0x000000006F49C000-memory.dmp

Filesize
304KB

Download
memory/3296-1763-0x0000000005440000-0x00000000059E6000-memory.dmp

Filesize
5.6MB

Download
memory/3296-1788-0x00000000746A0000-0x0000000074E51000-memory.dmp

Filesize
7.7MB

Download
memory/3296-1930-0x0000000000640000-0x000000000064A000-memory.dmp

Filesize
40KB

Download
memory/3296-1762-0x0000000004DA0000-0x0000000004E3C000-memory.dmp

Filesize
624KB

Download
memory/3296-1767-0x00000000746A0000-0x0000000074E51000-memory.dmp

Filesize
7.7MB

Download
memory/3296-1766-0x00000000050E0000-0x0000000005136000-memory.dmp

Filesize
344KB

Download
memory/3296-1765-0x0000000004E90000-0x0000000004E9A000-memory.dmp

Filesize
40KB

Download
memory/3296-1764-0x0000000004F30000-0x0000000004FC2000-memory.dmp

Filesize
584KB

Download
memory/3296-1760-0x00000000746AE000-0x00000000746AF000-memory.dmp

Filesize
4KB

Download
memory/3296-1920-0x0000000000640000-0x000000000064A000-memory.dmp

Filesize
40KB

Download
memory/3296-1919-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3296-1761-0x0000000000450000-0x0000000000484000-memory.dmp

Filesize
208KB

Download
memory/3420-1910-0x0000000000C30000-0x0000000000C6E000-memory.dmp

Filesize
248KB

Download
memory/3736-2248-0x000000001B900000-0x000000001B9A6000-memory.dmp

Filesize
664KB

Download
memory/3736-2252-0x000000001C730000-0x000000001C77C000-memory.dmp

Filesize
304KB

Download
memory/3736-2250-0x000000001C4D0000-0x000000001C56C000-memory.dmp

Filesize
624KB

Download
memory/3736-2251-0x0000000001470000-0x0000000001478000-memory.dmp

Filesize
32KB

Download
memory/3736-2249-0x000000001BED0000-0x000000001C39E000-memory.dmp

Filesize
4.8MB

Download
memory/4112-1898-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4200-1923-0x00000000008E0000-0x0000000000D0C000-memory.dmp

Filesize
4.2MB

Download
memory/4200-1925-0x0000000001010000-0x000000000101A000-memory.dmp

Filesize
40KB

Download
memory/4200-1933-0x0000000001010000-0x000000000101A000-memory.dmp

Filesize
40KB

Download
memory/4200-1924-0x00000000008E0000-0x0000000000D0C000-memory.dmp

Filesize
4.2MB

Download
memory/4276-1890-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4472-1850-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4544-1904-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4720-1848-0x00000000074A0000-0x00000000074BE000-memory.dmp

Filesize
120KB

Download
memory/4720-1853-0x0000000007880000-0x000000000788A000-memory.dmp

Filesize
40KB

Download
memory/4720-1775-0x0000000002CD0000-0x0000000002D06000-memory.dmp

Filesize
216KB

Download
memory/4720-1776-0x0000000005700000-0x0000000005D2A000-memory.dmp

Filesize
6.2MB

Download
memory/4720-1875-0x0000000007B40000-0x0000000007B48000-memory.dmp

Filesize
32KB

Download
memory/4720-1874-0x0000000007B50000-0x0000000007B6A000-memory.dmp

Filesize
104KB

Download
memory/4720-1873-0x0000000007A50000-0x0000000007A65000-memory.dmp

Filesize
84KB

Download
memory/4720-1777-0x00000000054F0000-0x0000000005512000-memory.dmp

Filesize
136KB

Download
memory/4720-1779-0x0000000005690000-0x00000000056F6000-memory.dmp

Filesize
408KB

Download
memory/4720-1864-0x0000000007A40000-0x0000000007A4E000-memory.dmp

Filesize
56KB

Download
memory/4720-1780-0x0000000005DA0000-0x0000000005E06000-memory.dmp

Filesize
408KB

Download
memory/4720-1863-0x0000000007A10000-0x0000000007A21000-memory.dmp

Filesize
68KB

Download
memory/4720-1796-0x0000000005FD0000-0x0000000006327000-memory.dmp

Filesize
3.3MB

Download
memory/4720-1797-0x00000000064A0000-0x00000000064BE000-memory.dmp

Filesize
120KB

Download
memory/4720-1798-0x00000000064F0000-0x000000000653C000-memory.dmp

Filesize
304KB

Download
memory/4720-1861-0x0000000007A90000-0x0000000007B26000-memory.dmp

Filesize
600KB

Download
memory/4720-1839-0x000000006F450000-0x000000006F49C000-memory.dmp

Filesize
304KB

Download
memory/4720-1838-0x0000000007440000-0x0000000007474000-memory.dmp

Filesize
208KB

Download
memory/4720-1849-0x00000000074C0000-0x0000000007564000-memory.dmp

Filesize
656KB

Download
memory/4720-1852-0x0000000007800000-0x000000000781A000-memory.dmp

Filesize
104KB

Download
memory/4720-1851-0x0000000007E40000-0x00000000084BA000-memory.dmp

Filesize
6.5MB

Download
memory/4764-1949-0x0000000000500000-0x000000000050A000-memory.dmp

Filesize
40KB

Download
memory/4764-1982-0x0000000000500000-0x000000000050A000-memory.dmp

Filesize
40KB

Download
memory/4900-1977-0x0000000000FC0000-0x0000000000FCA000-memory.dmp

Filesize
40KB

Download
memory/4900-1955-0x00000000008E0000-0x0000000000D0C000-memory.dmp

Filesize
4.2MB

Download
memory/4900-1954-0x00000000008E0000-0x0000000000D0C000-memory.dmp

Filesize
4.2MB

Download
memory/4900-1956-0x0000000000FC0000-0x0000000000FCA000-memory.dmp

Filesize
40KB

Download
memory/4920-2242-0x0000000000710000-0x0000000000742000-memory.dmp

Filesize
200KB

Download
memory/5100-2238-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/5100-2115-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/5100-1992-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/5100-1990-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/5100-1975-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/5100-1966-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download