MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b30eebf734354f55373978e395c912393f3c674aaa4717748ae449b09832f6ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BlackNET


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b30eebf734354f55373978e395c912393f3c674aaa4717748ae449b09832f6ae
SHA3-384 hash: 5995d66bfb095c5cb0de28579676bce29861ba23dbf6d55f0189ee8b14e96d493a953b271c5abf680d10cba4a8a1370c
SHA1 hash: f0704d227482a80f2f90dab79ed4acd9770fe565
MD5 hash: b72d429d1d690165c7b0de4a074c4a58
humanhash: robert-twelve-nuts-ink
File name:B30EEBF734354F55373978E395C912393F3C674AAA471.exe
Download: download sample
Signature BlackNET
Create hunting rule
File size:119'808 bytes
First seen:2021-08-01 09:45:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'653 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 3072:qwS9xonGdoFlC5w/oV9RRKyfKW63beFEKyBFfa1:5CeSKyRPfKWybi1
Threatray 17 similar samples on MalwareBazaar
TLSH T13BC3F61377EC5C65E1BEDBB4AB725280C7B5BD164922CB6C0CC060AD5AB7742B901BE3
dhash icon 414555c0d4d44503 (15 x njrat, 14 x BlackNET, 8 x Lucifer)
Reporter abuse_ch
Tags:BlackNet exe


Avatar
abuse_ch
BlackNET C2:
http://furyx.de/panel/receive.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://furyx.de/panel/receive.php https://threatfox.abuse.ch/ioc/165209/

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'948
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
B30EEBF734354F55373978E395C912393F3C674AAA471.exe
Verdict:
Malicious activity
Analysis date:
2021-08-01 09:47:44 UTC
Tags:
trojan blacknet
Link:
https://app.any.run/tasks/c85fc06f-6fa2-4d11-a37d-456f92a0e80b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
BlackNET
Create hunting rule
Link:
https://www.capesandbox.com/analysis/175559/
Detection(s):
Win.Trojan.Razy-9778111-0
Create hunting rule

Win.Malware.Ursu-9794593-0
Create hunting rule

Win.Packed.BlackNet-9866245-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Using the Windows Management Instrumentation requests
Connection attempt to an infection source
Sending an HTTP GET request to an infection source
Sending a UDP request
Enabling the 'hidden' option for analyzed file
Query of malicious DNS domain
Setting a global event handler for the keyboard
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
BlackNet RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/feb7f221-c932-475e-abf2-48d46688f646
Result
Threat name:
BlackNET
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/825063
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to log keystrokes (.Net Source)
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious names
Drops executables to the windows directory (C:\Windows) and starts them
Found strings related to Crypto-Mining
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected BlackNET
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 457471 Sample: B30EEBF734354F55373978E395C... Startdate: 01/08/2021 Architecture: WINDOWS Score: 100 69 clientconfig.passport.net 2->69 77 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->77 79 Multi AV Scanner detection for domain / URL 2->79 81 Malicious sample detected (through community Yara rule) 2->81 83 10 other signatures 2->83 9 B30EEBF734354F55373978E395C912393F3C674AAA471.exe 15 10 2->9         started        14 WindowsUpdate.exe 2->14         started        16 WindowsUpdate.exe 2->16         started        signatures3 process4 dnsIp5 75 furyx.de 172.67.163.203, 443, 49745, 49746 CLOUDFLARENETUS United States 9->75 59 C:\Windows\Microsoft\...\WindowsUpdate.exe, PE32 9->59 dropped 61 C:\Users\user\Desktop\svchosts.exe, PE32 9->61 dropped 63 C:\...\WindowsUpdate.exe:Zone.Identifier, ASCII 9->63 dropped 67 2 other malicious files 9->67 dropped 93 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 9->93 95 Creates autostart registry keys with suspicious names 9->95 97 Drops executables to the windows directory (C:\Windows) and starts them 9->97 99 2 other signatures 9->99 18 WindowsUpdate.exe 14 4 9->18         started        23 powershell.exe 21 9->23         started        25 schtasks.exe 1 9->25         started        27 schtasks.exe 9->27         started        65 C:\Users\user\...\WindowsUpdate.exe.log, ASCII 14->65 dropped file6 signatures7 process8 dnsIp9 71 104.21.15.192, 443, 49752, 49753 CLOUDFLARENETUS United States 18->71 73 furyx.de 18->73 57 C:\Windows\Microsoft\MyClient\svchosts.exe, PE32 18->57 dropped 85 Antivirus detection for dropped file 18->85 87 Multi AV Scanner detection for dropped file 18->87 89 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 18->89 91 Machine Learning detection for dropped file 18->91 29 powershell.exe 18->29         started        31 schtasks.exe 18->31         started        33 schtasks.exe 18->33         started        41 12 other processes 18->41 35 conhost.exe 23->35         started        37 conhost.exe 25->37         started        39 conhost.exe 27->39         started        file10 signatures11 process12 process13 43 conhost.exe 29->43         started        45 conhost.exe 31->45         started        47 conhost.exe 33->47         started        49 conhost.exe 41->49         started        51 conhost.exe 41->51         started        53 conhost.exe 41->53         started        55 9 other processes 41->55
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b30eebf734354f55373978e395c912393f3c674aaa4717748ae449b09832f6ae/
Threat name:
ByteCode-MSIL.Backdoor.Blacknet
Create hunting rule
Status:
Malicious
First seen:
2021-07-28 12:56:38 UTC
AV detection:
25 of 27 (92.59%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wmhox5zugvhvknzzpdrzlsishe7tyz2kvjdro5ek4re3bgbs62xa._file
Verdict:
unknown
Similar samples:
79e2a36d489c81158594c64d21808dc68b5fcb4eed68774d6810eea9f12b5b02
BlackNET
90071cffdfe6465b764829a706fe27f1abbb58d719bfcb428b210ae8c939a320
BlackNET
b9f183918ce6878943fa07f7522c0ca894ea454d5616fa387374e414dc935ee7
BlackNET
c214b31584d7f10aac62a292961052fecb27885fede2efe65c7f4cc40ae6dce0
BlackNET
c3cad420d5e8e63d11b2b00d198db8cdf12018ab7080f870b21e29f89a897868
BlackNET
cc5d048942af05983d2f2495d36c63164ac1ef6eeca86ce7835eae706dab476b
BlackNET
d238aea078ca1bb99a80ec2bf5d07acb818d72e7823ea8e767eefde95a038401
BlackNET
e6507f36045c13dee736bea44d61e90169ea69de61e9dc50b5743960c5b8f85a
BlackNET
e85dd1e7ab0b26928c8f917ff0849e745d975c97a9391171ea7218983e441eb3
BlackNET
e867582a41582f52cea35afbb16184d282682e0aaa828e5ee9ea36f834b5bb13
BlackNET
+ 7 additional samples on MalwareBazaar
Result
Malware family:
blacknet
Create hunting rule
Score:
  10/10
Tags:
family:blacknet evasion persistence suricata trojan
Link:
https://tria.ge/reports/210801-c2e8yegl7n/
Behaviour
Creates scheduled task(s)
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Adds Run key to start application
Windows security modification
Executes dropped EXE
BlackNET
BlackNET Payload
Contains code to disable Windows Defender
Modifies Windows Defender Real-time Protection settings
suricata: ET MALWARE Win32/BlackNET CnC Keep-Alive
Unpacked files
SH256 hash:
b30eebf734354f55373978e395c912393f3c674aaa4717748ae449b09832f6ae
MD5 hash:
b72d429d1d690165c7b0de4a074c4a58
SHA1 hash:
f0704d227482a80f2f90dab79ed4acd9770fe565
Detections:
win_blacknet_rat_w0
Create hunting rule
Link:
https://www.unpac.me/results/319f18d8-6ab3-4f24-922c-b3766b7a5bcb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b30eebf734354f55373978e395c912393f3c674aaa4717748ae449b09832f6ae

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Blacknet
Create hunting rule
Description:BlackNet Payload
Rule name:Blacknet
Create hunting rule
Description:BlackNet Payload
Rule name:d238aea078ca1bb99a80ec2bf5d07acb818d72e7823ea8e767eefde95a038401
Create hunting rule
Author:H3lium
Description:MALWARE! - file d238aea078ca1bb99a80ec2bf5d07acb818d72e7823ea8e767eefde95a038401.exe
Reference:https://github.com/Neo23x0/yarGen
Rule name:HKTL_NET_GUID_BlackNET
Create hunting rule
Author:Arnim Rupp
Description:Detects VB.NET red/black-team tools via typelibguid
Reference:https://github.com/BlackHacker511/BlackNET
Rule name:INDICATOR_SUSPICIOUS_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables containing artifcats associated with disabling Widnows Defender
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding registry key / value combination indicative of disabling Windows Defedner features
Rule name:MALWARE_Win_BlackNET
Create hunting rule
Author:ditekSHen
Description:Detects BlackNET RAT
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_Modified_SystemExeFileName_in_File
Create hunting rule
Author:Florian Roth
Description:Detecst a variant of a system file name often used by attackers to cloak their activity
Reference:https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/175559/

Comments