MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4054ee21cbfc210489f119c2d717ca1ae43129fc0d07aefe322fabb3b61d079f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BlackNET


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4054ee21cbfc210489f119c2d717ca1ae43129fc0d07aefe322fabb3b61d079f
SHA3-384 hash: d2fe219db2df144198d284228eb7dc58186030c76ad3eaf01c53ac57671217ec19fd58d2e85d35f1ce3033b1bcda433b
SHA1 hash: 7700f53b4de7abcd0aa28a1989f73aad394b49bb
MD5 hash: bc15770f9c1c0735cb5cc9d800476ab0
humanhash: sixteen-princess-harry-early
File name:4054EE21CBFC210489F119C2D717CA1AE43129FC0D07A.exe
Download: download sample
Signature BlackNET
Create hunting rule
File size:78'336 bytes
First seen:2021-08-24 22:47:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 1536:rRJABDWoKGVG6BOiBQAh4QiObju5FBHIIMLtfn:dJ3GVGdiBQAeQiObjsFBHIbl
Threatray 17 similar samples on MalwareBazaar
TLSH T1FD73F812BBE48965D6FEABF4D972A6014AF1B81A5532DB4C0CC271ED0AB7740CD41BB3
Reporter abuse_ch
Tags:BlackNet exe


Avatar
abuse_ch
BlackNET C2:
http://gpay-safe.ru/x//receive.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://gpay-safe.ru/x//receive.php https://threatfox.abuse.ch/ioc/193861/

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'164
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4054EE21CBFC210489F119C2D717CA1AE43129FC0D07A.exe
Verdict:
Malicious activity
Analysis date:
2021-08-24 22:49:16 UTC
Tags:
trojan blacknet keylogger
Link:
https://app.any.run/tasks/f5db2615-0927-4ab2-a854-e8e6802d0606

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
BlackNET
Create hunting rule
Link:
https://www.capesandbox.com/analysis/182033/
Detection(s):
Win.Trojan.Razy-9778111-0
Create hunting rule

ditekSHen.MALWARE.Win.Trojan.BlackNET.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
BlackNet RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/46239d61-b838-4248-b68b-73e3d9e220c6
Result
Threat name:
BlackNET
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/838636
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Creates autostart registry keys with suspicious names
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected BlackNET
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 471063 Sample: 4054EE21CBFC210489F119C2D71... Startdate: 25/08/2021 Architecture: WINDOWS Score: 100 70 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->70 72 Multi AV Scanner detection for domain / URL 2->72 74 Found malware configuration 2->74 76 9 other signatures 2->76 8 4054EE21CBFC210489F119C2D717CA1AE43129FC0D07A.exe 15 10 2->8         started        12 4054EE21CBFC210489F119C2D717CA1AE43129FC0D07A.exe 1 7 2->12         started        14 winhost.exe 2->14         started        process3 dnsIp4 68 gpay-safe.ru 91.206.93.216, 49724, 49725, 49726 ASBAXETNRU Russian Federation 8->68 54 4054EE21CBFC210489...3129FC0D07A.exe.log, ASCII 8->54 dropped 17 winhost.exe 15 6 8->17         started        21 cmd.exe 1 8->21         started        56 C:\Users\user\AppData\Local\...\winhost.exe, PE32 12->56 dropped 58 C:\Users\user\...\winhost.exe:Zone.Identifier, ASCII 12->58 dropped 23 winhost.exe 12->23         started        25 cmd.exe 12->25         started        90 Creates autostart registry keys with suspicious names 14->90 27 cmd.exe 14->27         started        file5 signatures6 process7 dnsIp8 60 gpay-safe.ru 17->60 62 192.168.2.1 unknown unknown 17->62 78 Antivirus detection for dropped file 17->78 80 Multi AV Scanner detection for dropped file 17->80 82 Machine Learning detection for dropped file 17->82 29 cmd.exe 1 17->29         started        64 1.1.1.1 CLOUDFLARENETUS Australia 21->64 84 Uses ping.exe to sleep 21->84 86 Uses ping.exe to check the status of other devices and networks 21->86 32 conhost.exe 21->32         started        34 PING.EXE 1 21->34         started        66 gpay-safe.ru 23->66 36 cmd.exe 23->36         started        38 conhost.exe 25->38         started        40 PING.EXE 25->40         started        42 conhost.exe 27->42         started        44 PING.EXE 27->44         started        signatures9 process10 signatures11 88 Uses ping.exe to sleep 29->88 46 conhost.exe 29->46         started        48 PING.EXE 1 29->48         started        50 conhost.exe 36->50         started        52 PING.EXE 36->52         started        process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4054ee21cbfc210489f119c2d717ca1ae43129fc0d07aefe322fabb3b61d079f/
Threat name:
ByteCode-MSIL.Backdoor.Blacknet
Create hunting rule
Status:
Malicious
First seen:
2021-08-19 13:20:00 UTC
AV detection:
23 of 27 (85.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ibko4iol7qqqjcprdhbnof6kdlsdckp4bud257rsf6v3hnq5a6pq._file
Verdict:
unknown
Similar samples:
5b14d9674cbd536403423c9822182497469034a86ad12ced50ab02bdc9166cce
BlackNET
b30eebf734354f55373978e395c912393f3c674aaa4717748ae449b09832f6ae
BlackNET
c3cad420d5e8e63d11b2b00d198db8cdf12018ab7080f870b21e29f89a897868
BlackNET
cc5d048942af05983d2f2495d36c63164ac1ef6eeca86ce7835eae706dab476b
BlackNET
d238aea078ca1bb99a80ec2bf5d07acb818d72e7823ea8e767eefde95a038401
BlackNET
e6507f36045c13dee736bea44d61e90169ea69de61e9dc50b5743960c5b8f85a
BlackNET
e867582a41582f52cea35afbb16184d282682e0aaa828e5ee9ea36f834b5bb13
BlackNET
+ 7 additional samples on MalwareBazaar
Result
Malware family:
blacknet
Create hunting rule
Score:
  10/10
Tags:
family:blacknet botnet:hack persistence trojan
Link:
https://tria.ge/reports/210824-wczczzmvhx/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Executes dropped EXE
BlackNET
BlackNET Payload
Malware Config
C2 Extraction:
http://gpay-safe.ru/x/
Unpacked files
SH256 hash:
4054ee21cbfc210489f119c2d717ca1ae43129fc0d07aefe322fabb3b61d079f
MD5 hash:
bc15770f9c1c0735cb5cc9d800476ab0
SHA1 hash:
7700f53b4de7abcd0aa28a1989f73aad394b49bb
Detections:
win_blacknet_rat_w0
Create hunting rule
Link:
https://www.unpac.me/results/c49dd3f7-4c74-4fe3-9d7d-7f575cb7b807/
Malware family:
BlackWorm
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/4054ee21cbfc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.50
Link:
https://yomi.yoroi.company/submissions/4054ee21cbfc210489f119c2d717ca1ae43129fc0d07aefe322fabb3b61d079f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Blacknet
Create hunting rule
Description:BlackNet Payload
Rule name:Blacknet
Create hunting rule
Description:BlackNet Payload
Rule name:CN_disclosed_20180208_c
Create hunting rule
Author:Florian Roth
Description:Detects malware from disclosed CN malware set
Reference:https://twitter.com/cyberintproject/status/961714165550342146
Rule name:d238aea078ca1bb99a80ec2bf5d07acb818d72e7823ea8e767eefde95a038401
Create hunting rule
Author:H3lium
Description:MALWARE! - file d238aea078ca1bb99a80ec2bf5d07acb818d72e7823ea8e767eefde95a038401.exe
Reference:https://github.com/Neo23x0/yarGen
Rule name:HKTL_NET_GUID_BlackNET
Create hunting rule
Author:Arnim Rupp
Description:Detects VB.NET red/black-team tools via typelibguid
Reference:https://github.com/BlackHacker511/BlackNET
Rule name:MALWARE_Win_BlackNET
Create hunting rule
Author:ditekSHen
Description:Detects BlackNET RAT
Rule name:MAL_Winnti_Sample_May18_1
Create hunting rule
Author:Florian Roth
Description:Detects malware sample from Burning Umbrella report - Generic Winnti Rule
Reference:https://401trg.pw/burning-umbrella/
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_Modified_SystemExeFileName_in_File
Create hunting rule
Author:Florian Roth
Description:Detecst a variant of a system file name often used by attackers to cloak their activity
Reference:https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/182033/

Comments