MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 335e1929c37823fa8c1a530a75a6a155a578c8eeba180a641e480fb6dcfea1c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BlackNET


Vendor detections: 9


Intelligence 9 IOCs 1 YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 335e1929c37823fa8c1a530a75a6a155a578c8eeba180a641e480fb6dcfea1c4
SHA3-384 hash: 5dd1b82508620f433104052686b1123663fdb029694bbc57326019ac85fcbacdbf897f97e3e0aa1f1d9a65c3011684a8
SHA1 hash: e0f3bd413a54eadbf3a936350a75102e556a6464
MD5 hash: 34cfa7614aaa14211f4025bc1d7d1710
humanhash: enemy-uranus-earth-oscar
File name:335E1929C37823FA8C1A530A75A6A155A578C8EEBA180.exe
Download: download sample
Signature BlackNET
Create hunting rule
File size:1'188'864 bytes
First seen:2021-05-29 12:10:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2e5467cba76f44a088d39f78c5e807b6 (131 x DCRat, 113 x njrat, 80 x RedLineStealer)
ssdeep 24576:GkWYW8x3WBtYdgffj0fFVUpZwOrSCE2EkF37P+eIqC8Ve8g+sD:qYW8xJ64dcZ7tE2EkV7mfqCVD
Threatray 9 similar samples on MalwareBazaar
TLSH C34533B4B4334FDFF217A67638A264A411351C3C931602BB4837579CD0C1A6B25BEEAE
Reporter abuse_ch
Tags:BlackNet exe


Avatar
abuse_ch
BlackNET C2:
http://45.130.138.51//receive.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://45.130.138.51//receive.php https://threatfox.abuse.ch/ioc/66774/

Intelligence

File Origin
# of uploads :
1
# of downloads :
333
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
335E1929C37823FA8C1A530A75A6A155A578C8EEBA180.exe
Verdict:
Malicious activity
Analysis date:
2021-05-29 12:18:23 UTC
Tags:
trojan blacknet
Link:
https://app.any.run/tasks/648eb548-7de8-4522-93cf-50f62fe7c13f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
BlackNET
Create hunting rule
Link:
https://www.capesandbox.com/analysis/163167/
Detection(s):
Win.Packed.Enigma-9837395-0
Create hunting rule

Win.Trojan.Generic-9860217-0
Create hunting rule

PUA.Win.Packer.EnigmaProtector-9852682-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for analyzing tools
Creating a window
Using the Windows Management Instrumentation requests
Sending a UDP request
Sending an HTTP GET request
Running batch commands
Creating a process with a hidden window
Creating a file
Launching a process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
BlackNET
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/794239
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Creates an undocumented autostart registry key
Creates autostart registry keys with suspicious names
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found strings related to Crypto-Mining
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file has nameless sections
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected BlackNET
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 426635 Sample: 335E1929C37823FA8C1A530A75A... Startdate: 29/05/2021 Architecture: WINDOWS Score: 100 40 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->40 42 Found malware configuration 2->42 44 Antivirus / Scanner detection for submitted sample 2->44 46 9 other signatures 2->46 7 335E1929C37823FA8C1A530A75A6A155A578C8EEBA180.exe 17 4 2->7         started        12 335E1929C37823FA8C1A530A75A6A155A578C8EEBA180.exe 1 3 2->12         started        14 335E1929C37823FA8C1A530A75A6A155A578C8EEBA180.exe 2 2->14         started        process3 dnsIp4 34 45.130.138.51, 49715, 49717, 49720 AS45671-NET-AUWholesaleServicesProviderAU Netherlands 7->34 30 335E1929C37823FA8C...78C8EEBA180.exe.log, ASCII 7->30 dropped 48 Detected unpacking (changes PE section rights) 7->48 50 Detected unpacking (overwrites its own PE header) 7->50 52 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 7->52 58 2 other signatures 7->58 16 cmd.exe 1 7->16         started        54 Creates autostart registry keys with suspicious names 12->54 56 Hides threads from debuggers 12->56 20 cmd.exe 12->20         started        file5 signatures6 process7 dnsIp8 32 1.1.1.1 CLOUDFLARENETUS Australia 16->32 36 Uses ping.exe to sleep 16->36 38 Uses ping.exe to check the status of other devices and networks 16->38 22 conhost.exe 16->22         started        24 PING.EXE 1 16->24         started        26 conhost.exe 20->26         started        28 PING.EXE 20->28         started        signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/335e1929c37823fa8c1a530a75a6a155a578c8eeba180a641e480fb6dcfea1c4/
Threat name:
Win32.Trojan.Enigma
Create hunting rule
Status:
Malicious
First seen:
2021-02-27 00:10:16 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gnpbskodpar7vda2kmfhljvbkwsxrshoximauza6jah3nxh6uhca._file
Verdict:
suspicious
Similar samples:
06464b0e584f2b64445ef449924c57a5b8d7472056af2eb53f5f6d8d56cce81a
BlackNET
06aba312b446bf01180d633c94686c5ab2d102d40156b5cd9a9255cc6fd5b69c
BlackNET
3d031ccd29e2ee2a59b640b2644b68121351917397bd6a9a0fd31b359e1c73bd
BlackNET
6b0e5c2c2ada15f3690393c85b80e58165a1e4f2d6736c8a76b3995c899c623d
BlackNET
9a0d57d82e15f4f45a2442d1d5355242a0fe4684039777025622dfa95a8caeec
BlackNET
9cda5e5ad6ca68a803516013fbf62e6b06383b20fccf1ee6aed4730c916a3b55
BlackNET
cce923d986150e68dbb2b1686f4cb3af665b2d473d66226e20e0d1509d04b192
BlackNET
f47e5170400f759777d84d93b114348b904aed870ee7d39a697f8b1f884d77ae
BlackNET
feb6b08e0303e743ce20c4de0cb48f1b230cc80251ecf067f8ba05c88889999b
BlackNET
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence
Link:
https://tria.ge/reports/210529-9e85t8l83s/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Deletes itself
Modifies WinLogon for persistence
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/335e1929c37823fa8c1a530a75a6a155a578c8eeba180a641e480fb6dcfea1c4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BlackWorm
Create hunting rule
Author:Brian Wallace @botnet_hunter
Description:Identify BlackWorm
Rule name:Cryptocoin_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria
Rule name:EnigmaStub
Create hunting rule
Author:@bartblaze
Description:Identifies Enigma packer stub.
Rule name:HKTL_NET_GUID_BlackNET
Create hunting rule
Author:Arnim Rupp
Description:Detects VB.NET red/black-team tools via typelibguid
Reference:https://github.com/BlackHacker511/BlackNET
Rule name:INDICATOR_SUSPICIOUS_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables containing artifcats associated with disabling Widnows Defender
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_BlackNET
Create hunting rule
Author:ditekSHen
Description:Detects BlackNET RAT
Rule name:pe_imphash
Create hunting rule
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Stealer_word_in_memory
Create hunting rule
Author:James_inthe_box
Description:The actual word stealer in memory
Rule name:win_smominru_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/163167/

Comments