Extracted

• • Target
    npcap-1.77.exe
  • Size 1.1MB
  • SHA256 4b8896513505dde38b8250bfbb1c413deecde78aabda11f6a65c2ee250ddd79f
  • MD5 6c8216d28b8ceaf4afba221f15312afc
  • SHA1 bd6e15f6137ab0a1474d1c75c4c3cd25a4000859
  • SHA512 cf16fd5037e8f044dc8a6b0d10dd731350a2fce15b29be76b5bd092eb55f69c5d6ecd95ece5cd5c5e935b945a2d76dc559cbf9e36e913598830ae299477c7ee2
  • SSDEEP 24576:PJzNjLA70sGjPJ0icS7pUrqSyHdrXPM7RM9vMGiIHs:9Nj82jR0icSdcq7HRWRM9vxies
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  blacknetbot01defense_evasiondiscoverypersistenceprivilege_escalationransomwarespywarestealertrojan

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Blacknet family

    blacknet

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Drops file in Drivers directory

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Adds Run key to start application

    persistence

  • Checks for any installed AV software in registry

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  behavioral1
• • Target
    $PLUGINSDIR/InstallOptions.dll
  • Size 22KB
  • SHA256 61ea114d9d0cd1e884535095aa3527a6c28df55a4ecee733c8c398f50b84cc3d
  • MD5 170c17ac80215d0a377b42557252ae10
  • SHA1 4cbab6cc189d02170dd3ba7c25aa492031679411
  • SHA512 0fd65cad0fcaa98083c2021de3d6429e79978658809c62ae9e4ed630c016915ced36aa52f2f692986c3b600c92325e79fd6d757634e8e02d5e582ff03679163f
  • SSDEEP 384:E0C43tPegZ3eBaRwCPOYY7nNYXCA/YosaWqZmZsHLA+KhHgt:EBTgZ3eBTCmrnNAEQ1hKhHgt
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral2
• • Target
    $PLUGINSDIR/NPFInstall.exe
  • Size 251KB
  • SHA256 ab15dad8d35b1a92851b0d257b28d85c102ea5e7ed386c61780022fdeaa7aa20
  • MD5 cbd5412474f4e4244b485ed9c3a68d08
  • SHA1 d7707ae1e1499f92efeafbc884cc5c9cceafae79
  • SHA512 eeb938a67e33083c2110f327823197e84db1a637eeb32b7264e6d772f403e6a1c106fb06cb5ffc330755eb73f0978e501cc434c681f12a67c5b8ca661acadaf3
  • SSDEEP 3072:VeAvCTO25maSEPJJ1SxLtfJ5OGydgzwpXzcbU0ZFoecBkB3K9GyNyOLbTOa1sfn2:VTCS+bM3MEU0Tjcb9rNyh0NzuW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  4^/10
  behavioral3
• • Target
    $PLUGINSDIR/SysRestore.dll
  • Size 12KB
  • SHA256 49b0450567c281494620193d0f3598bad8a474ae9910fedb161855f09a8ec1f0
  • MD5 d1a3f71186e20741b2bb0cc33ca79609
  • SHA1 b04761c0b7bc46e864a776514e4476eb372ef73c
  • SHA512 7eb904e4d2a6d87bccbe3e3f6562e53940195303a8024d2b0dad142a7a546b7a7a9287966e6d696246349008966349b6b56a3ce47978dedf49205bcfeb962b16
  • SSDEEP 192:Qa8pU6GVdndRqSzNJw7YUXmZscF8Bd1LAeVBZHlA6u/:upZGVdndRqSzNqZmZsHLAOhk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral4
• • Target
    $PLUGINSDIR/System.dll
  • Size 19KB
  • SHA256 7efe73a8d32ed1b01727ad4579e9eec49c9309f2cb7bf03c8afa80d70242d1c0
  • MD5 f020a8d9ede1fb2af3651ad6e0ac9cb1
  • SHA1 341f9345d669432b2a51d107cbd101e8b82e37b1
  • SHA512 408fa5a797d3ff4b917bb4107771687004ba507a33cb5944b1cc3155e0372cb3e04a147f73852b9134f138ff709af3b0fb493cd8fa816c59e9f3d9b5649c68c4
  • SSDEEP 384:u8+Qlt70Fj/lQRY/9VjjgLmqZmZsHLAMThHdjnG:uSqFjm6YLP17ThHdC
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral5
• • Target
    $PLUGINSDIR/nsExec.dll
  • Size 14KB
  • SHA256 274e53dc8c5ddc273a6f5683b71b882ef8917029e2eaf6c8dbee0c62d999225d
  • MD5 f9e61a25016dcb49867477c1e71a704e
  • SHA1 c01dc1fa7475e4812d158d6c00533410c597b5d9
  • SHA512 b4a6289ef9e761e29dd5362fecb1707c97d7cb3e160f4180036a96f2f904b2c64a075b5bf0fea4a3bb94dea97f3cfa0d057d3d6865c68da65fdcb9c3070c33d8
  • SSDEEP 192:JDkDr/HA5v6G2IElFernNQZGdHskJw7YUXmZscF8Bd1LOtNBZHld3Mu:aDrvAxnJGernNQZGdHVqZmZsHLOtLhHH
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral6
• • Target
    NPFInstall.exe
  • Size 251KB
  • SHA256 ab15dad8d35b1a92851b0d257b28d85c102ea5e7ed386c61780022fdeaa7aa20
  • MD5 cbd5412474f4e4244b485ed9c3a68d08
  • SHA1 d7707ae1e1499f92efeafbc884cc5c9cceafae79
  • SHA512 eeb938a67e33083c2110f327823197e84db1a637eeb32b7264e6d772f403e6a1c106fb06cb5ffc330755eb73f0978e501cc434c681f12a67c5b8ca661acadaf3
  • SSDEEP 3072:VeAvCTO25maSEPJJ1SxLtfJ5OGydgzwpXzcbU0ZFoecBkB3K9GyNyOLbTOa1sfn2:VTCS+bM3MEU0Tjcb9rNyh0NzuW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  4^/10
  behavioral7
• • Target
    x64/NPFInstall.exe
  • Size 300KB
  • SHA256 89ea907aa23dfadc6448a5f520100c39d194c1b4f12da901a1bed7f8c4106312
  • MD5 33cd4352326bb8d012e16e492eef730a
  • SHA1 91ad1dc7a816437335c100377f7a0735964f6fae
  • SHA512 34834dc6b65be975b7911ef2ce36af26d67f47e54182c44bb4b16f9d6dbe3c37b829a7bc41f150e8dced3a562ac5301d8277d06659098e9ab86ff18dd10988f4
  • SSDEEP 6144:57sjTspITygzeDpTkkUyyC5KEmg37kpFXQOj8xgI3:ejc2byDpTkdyT5fTrkpVQlxgI3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  4^/10
  behavioral8