Overview

overview

10

Static

static

3

02d84ab808...cf.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    02d84ab808655cbe2cb4737e9c01544345b2f91bdfc03b29c0e061bee2e883cf.zip
  • Size 655KB
  • Sample260706-eqbkhahw4x
  • SHA256 030bb262c95ab1b18f96c8d4a6850f725778835f3f59c8f9fba28d2488b31948
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
blacknethacked by mustymoneydefense_evasiondiscoverytrojan

Malware Config

Extracted

Family

  • blacknet

Version

  • v3.5 Public

Botnet

  • HacKed By MustyMoney

C2

  • http://ratking.ddns.net

Mutex

  • BN[telsJjiy-9983844]

Attributes
  • antivm

    false

  • elevate_uac

    false

  • install_name

    WindowsUpdate.exe

  • splitter

    |BN|

  • start_name

    14247ae8e9bdf8a07859c46cc6c701e5

  • startup

    false

  • usb_spread

    false

Targets

    • Target
      02d84ab808655cbe2cb4737e9c01544345b2f91bdfc03b29c0e061bee2e883cf.exe
    • Size 833KB
    • SHA256 02d84ab808655cbe2cb4737e9c01544345b2f91bdfc03b29c0e061bee2e883cf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    hacked by mustymoneydefense_evasiondiscoveryblacknettrojan

    • BlackNET payload

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Family: BlackNET

      BlackNET is an open source remote access tool written in VB.NET.

      trojanblacknet

    • Looks for VirtualBox Guest Additions in registry

      defense_evasion

    • Looks for VMWare Tools registry key

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks