MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af4586015e689d670854702df4aa5748eb90da472dc6c479f065bfb49e624d0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BlackNET


Vendor detections: 9


Intelligence 9 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af4586015e689d670854702df4aa5748eb90da472dc6c479f065bfb49e624d0c
SHA3-384 hash: 12ba2b31bd74e6ee0eb9c6784a8dd1f0ccef70518c4bd012e705506fd8579d36146bbef713530c57ab8eb02f94e435a8
SHA1 hash: b4febb6af54c4ddc31fb821159528e2257367ca1
MD5 hash: fe562bb60356ea0885d298fee6e0772a
humanhash: october-equal-pizza-cat
File name:cheat.bin
Download: download sample
Signature BlackNET
Create hunting rule
File size:262'144 bytes
First seen:2021-04-08 11:56:39 UTC
Last seen:2021-04-08 12:53:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:hO5tKvQpahfMKZanfet3Agp0q9ygbX+1RzDU8:hCglansaMJcR/V
Threatray 3 similar samples on MalwareBazaar
TLSH 5844120567C28F6CC7954A7E2D70D1109CBAB19BEA86E7BB198C316C17A33B701E7271
Reporter JAMESWT_WT
Tags:141.8.192.163 a0524310.xsph.ru BlackNet

Intelligence

File Origin
# of uploads :
3
# of downloads :
212
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cheat.exe
Verdict:
Malicious activity
Analysis date:
2021-03-21 01:41:02 UTC
Tags:
trojan blacknet
Link:
https://app.any.run/tasks/8cecc0bf-7361-433a-be4a-903441b04b49

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
BlackNET
Create hunting rule
Link:
https://www.capesandbox.com/analysis/133184/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader33.63365.26320.28940.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Sending a UDP request
Creating a file
Creating a process from a recently created file
Launching a process
Using the Windows Management Instrumentation requests
DNS request
Sending an HTTP GET request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
BlackNET
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/670124
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to log keystrokes (.Net Source)
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious names
Creates multiple autostart registry keys
Drops PE files to the document folder of the user
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected BlackNET
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 384005 Sample: cheat.bin Startdate: 08/04/2021 Architecture: WINDOWS Score: 100 42 a0524310.xsph.ru 2->42 46 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 Antivirus / Scanner detection for submitted sample 2->50 52 9 other signatures 2->52 8 cheat.exe 7 2->8         started        12 vlc.exe 3 2->12         started        14 vlc.exe 2->14         started        16 2 other processes 2->16 signatures3 process4 file5 36 C:\Users\user\Documents\chome_exe\vlc.exe, PE32 8->36 dropped 38 C:\Users\user\AppData\...\AgileDotNetRT.dll, PE32 8->38 dropped 40 C:\Users\user\AppData\Local\...\cheat.exe.log, ASCII 8->40 dropped 60 Drops PE files to the document folder of the user 8->60 62 Tries to detect virtualization through RDTSC time measurements 8->62 18 RegAsm.exe 16 2 8->18         started        22 powershell.exe 1 20 8->22         started        64 Antivirus detection for dropped file 12->64 66 Multi AV Scanner detection for dropped file 12->66 68 Machine Learning detection for dropped file 12->68 24 RegAsm.exe 12->24         started        26 RegAsm.exe 14->26         started        28 RegAsm.exe 14->28         started        30 conhost.exe 16->30         started        32 conhost.exe 16->32         started        signatures6 process7 dnsIp8 44 a0524310.xsph.ru 141.8.192.163, 49712, 49717, 49723 SPRINTHOSTRU Russian Federation 18->44 54 Creates autostart registry keys with suspicious names 18->54 56 Creates multiple autostart registry keys 18->56 58 Creates an autostart registry key pointing to binary in C:\Windows 18->58 34 conhost.exe 22->34         started        signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/af4586015e689d670854702df4aa5748eb90da472dc6c479f065bfb49e624d0c/
Threat name:
ByteCode-MSIL.Trojan.Shelma
Create hunting rule
Status:
Malicious
First seen:
2021-03-21 04:03:59 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
002a25d22717f4c57eb76e117bf6e2598a3123160e34b4d242b896fe798da967
BlackNET
c4b40854b0d96e0967c64ee0f80d41222d57029ec9e3e4b72f4232291879caad
BlackNET
f1e69833ed94c69e8e447ab280d677dbf3bd7df8fcc3aa1fc819fbe58703e9c7
BlackNET
Result
Malware family:
blacknet
Create hunting rule
Score:
  10/10
Tags:
family:blacknet agilenet persistence trojan
Link:
https://tria.ge/reports/210408-lvna44jzg6/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Program crash
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
BlackNET
BlackNET Payload
Contains code to disable Windows Defender
Unpacked files
SH256 hash:
55ff1e0a4e5866d565ceeb9baafac73fdcb4464160fc6c78104d935009935cd7
MD5 hash:
edd74be9723cdc6a5692954f0e51c9f3
SHA1 hash:
e9fb66ceee1ba4ce7e5b8271b3e1ed7cb9acf686
Link:
https://www.unpac.me/results/a8704f84-267b-4a44-871a-a14aae1719c8/
SH256 hash:
3be7df4f3c77641d3c8adbb35afff7f242e16284d417488af1cee810323b87b9
MD5 hash:
0299f0c72a019b6f25de4e3e98fa83d1
SHA1 hash:
b4293f317096e8179ad3079789cf2b2f2db2aad5
Link:
https://www.unpac.me/results/a8704f84-267b-4a44-871a-a14aae1719c8/
SH256 hash:
02fb6da15b0c081cf8caf4aeb88143be34efbabaa09a7a96f65758735952b5f6
MD5 hash:
7530d8a49dbfc118e66f5eff32582256
SHA1 hash:
7b56d3ca63304ca8b2675eb46ec3682c97391858
Link:
https://www.unpac.me/results/a8704f84-267b-4a44-871a-a14aae1719c8/
SH256 hash:
af4586015e689d670854702df4aa5748eb90da472dc6c479f065bfb49e624d0c
MD5 hash:
fe562bb60356ea0885d298fee6e0772a
SHA1 hash:
b4febb6af54c4ddc31fb821159528e2257367ca1
Link:
https://www.unpac.me/results/a8704f84-267b-4a44-871a-a14aae1719c8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/af4586015e689d670854702df4aa5748eb90da472dc6c479f065bfb49e624d0c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Blacknet
Create hunting rule
Description:BlackNet Payload
Rule name:BlackWorm
Create hunting rule
Author:Brian Wallace @botnet_hunter
Description:Identify BlackWorm
Rule name:CN_disclosed_20180208_c
Create hunting rule
Author:Florian Roth
Description:Detects malware from disclosed CN malware set
Reference:https://twitter.com/cyberintproject/status/961714165550342146
Rule name:INDICATOR_SUSPICIOUS_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables containing artifcats associated with disabling Widnows Defender
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_BlackNET
Create hunting rule
Author:ditekSHen
Description:Detects BlackNET RAT
Rule name:MAL_Winnti_Sample_May18_1
Create hunting rule
Author:Florian Roth
Description:Detects malware sample from Burning Umbrella report - Generic Winnti Rule
Reference:https://401trg.pw/burning-umbrella/
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:Stealer_word_in_memory
Create hunting rule
Author:James_inthe_box
Description:The actual word stealer in memory
Rule name:SUSP_Modified_SystemExeFileName_in_File
Create hunting rule
Author:Florian Roth
Description:Detecst a variant of a system file name often used by attackers to cloak their activity
Reference:https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/133184/

Comments