MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6507f36045c13dee736bea44d61e90169ea69de61e9dc50b5743960c5b8f85a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BlackNET


Vendor detections: 9


Intelligence 9 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e6507f36045c13dee736bea44d61e90169ea69de61e9dc50b5743960c5b8f85a
SHA3-384 hash: 9686587eac441b6c22cb4fc0c2b4be420eefa32628dd4cc8ad61407a3f120149aa889b4bf472406fab81ec72f0dffcc6
SHA1 hash: 2359c8459c1e1dd133c2842b51d2982e63016f92
MD5 hash: 97cb3fda3cff430377a866d6b437de8f
humanhash: jig-avocado-december-five
File name:E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe
Download: download sample
Signature BlackNET
Create hunting rule
File size:225'280 bytes
First seen:2021-08-01 01:25:45 UTC
Last seen:2021-08-01 01:35:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'207 x SnakeKeylogger)
ssdeep 3072:alaJEgEXbfa9K4Em8wNBiXMhDJv7WehI2135eDRCyqTp0FUSVBOHfHAXTRsPCgfr:BEg4S9KqiSJvthI25ebqqBOKTRsaj2e
Threatray 32 similar samples on MalwareBazaar
TLSH T1EE2402793DE54976C29ECE335CE174209A618835487FA99FEE84D2184999342F3E33BC
Reporter abuse_ch
Tags:BlackNet exe


Avatar
abuse_ch
BlackNET C2:
http://furyx.de/panel/receive.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://furyx.de/panel/receive.php https://threatfox.abuse.ch/ioc/165209/

Intelligence

File Origin
# of uploads :
2
# of downloads :
2'543
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe
Verdict:
No threats detected
Analysis date:
2021-08-01 01:31:07 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/be38a9ff-f2e6-4dbb-aa6f-ddac84bc9c9d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
BlackNET
Create hunting rule
Link:
https://www.capesandbox.com/analysis/175523/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.508.30540.19546.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
BlackNet RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/daf8dfa8-9715-41d7-8c3b-aa8220690659
Result
Threat name:
BlackNET
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/824992
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to hide user accounts
Contains functionality to log keystrokes (.Net Source)
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious names
Creates multiple autostart registry keys
Disables Windows Defender (via service or powershell)
Drops executables to the windows directory (C:\Windows) and starts them
Found strings related to Crypto-Mining
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses cmd line tools excessively to alter registry or file data
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected BlackNET
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 457404 Sample: E6507F36045C13DEE736BEA44D6... Startdate: 01/08/2021 Architecture: WINDOWS Score: 100 102 furyx.de 2->102 112 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->112 114 Multi AV Scanner detection for domain / URL 2->114 116 Malicious sample detected (through community Yara rule) 2->116 118 15 other signatures 2->118 12 E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe 1 4 2->12         started        16 Windows Update.exe 1 2->16         started        18 Windows Update.exe 2->18         started        signatures3 process4 file5 88 C:\Users\user\AppData\...\Windows Update.exe, PE32 12->88 dropped 90 C:\...\Windows Update.exe:Zone.Identifier, ASCII 12->90 dropped 92 E6507F36045C13DEE7...EA69DE61E9D.exe.log, ASCII 12->92 dropped 122 Creates multiple autostart registry keys 12->122 124 Injects a PE file into a foreign processes 12->124 20 E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe 5 12->20         started        24 Windows Update.exe 4 16->24         started        26 Windows Update.exe 18->26         started        signatures6 process7 file8 84 C:\Users\user\AppData\Local\Temp\furz.exe, PE32 20->84 dropped 120 Hides that the sample has been downloaded from the Internet (zone.identifier) 20->120 28 furz.exe 15 8 20->28         started        33 UacTest.exe 20->33         started        35 cmd.exe 20->35         started        86 C:\Users\user\AppData\Local\...\UacTest.exe, PE32 24->86 dropped 37 cmd.exe 24->37         started        39 UacTest.exe 24->39         started        41 cmd.exe 26->41         started        signatures9 process10 dnsIp11 104 furyx.de 172.67.163.203, 443, 49724, 49725 CLOUDFLARENETUS United States 28->104 106 192.168.2.1 unknown unknown 28->106 94 C:\Windows\Microsoft\...\WindowsUpdate.exe, PE32 28->94 dropped 96 C:\Users\user\AppData\Local\...\svchosts.exe, PE32 28->96 dropped 130 Antivirus detection for dropped file 28->130 132 Multi AV Scanner detection for dropped file 28->132 134 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 28->134 142 5 other signatures 28->142 43 powershell.exe 28->43         started        98 C:\Users\user\AppData\Local\...\Mnrjvryib.exe, PE32 33->98 dropped 136 Machine Learning detection for dropped file 33->136 45 Inpwdja.exe 33->45         started        48 Mnrjvryib.exe 33->48         started        108 1.1.1.1 CLOUDFLARENETUS Australia 35->108 138 Uses ping.exe to sleep 35->138 140 Uses ping.exe to check the status of other devices and networks 35->140 50 conhost.exe 35->50         started        52 PING.EXE 35->52         started        54 PING.EXE 35->54         started        58 3 other processes 37->58 100 C:\Users\user\AppData\Local\...\Inpwdja.exe, PE32 39->100 dropped 56 Inpwdja.exe 39->56         started        60 3 other processes 41->60 file12 signatures13 process14 signatures15 62 conhost.exe 43->62         started        126 Multi AV Scanner detection for dropped file 45->126 64 cmd.exe 45->64         started        67 conhost.exe 45->67         started        69 cmd.exe 48->69         started        71 conhost.exe 48->71         started        73 conhost.exe 56->73         started        75 cmd.exe 56->75         started        process16 signatures17 110 Uses cmd line tools excessively to alter registry or file data 64->110 77 cmd.exe 64->77         started        80 taskkill.exe 69->80         started        process18 signatures19 128 Uses cmd line tools excessively to alter registry or file data 77->128 82 reg.exe 77->82         started        process20
Gathering data
Threat name:
Win32.Trojan.Tiggre
Create hunting rule
Status:
Malicious
First seen:
2021-07-27 15:39:49 UTC
AV detection:
21 of 27 (77.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4zih6nqelqj55zzwx2se2ypjafu6u2o6mhu5yufvoq4wbrny7bna._file
Verdict:
suspicious
Similar samples:
9da009d5ba4d56b1ea8360698a817fe6e321964998ed68ce40d0ce14b4c49762
BlackNET
bf5d5c28bec7bdcf41fad771fd465ba6bb9a56e053c9470a6e10293466109d3c
BlackNET
c214b31584d7f10aac62a292961052fecb27885fede2efe65c7f4cc40ae6dce0
BlackNET
c35d8629ac725a6fd6bc953e5f86e4fa1b8a3680b367b52b33880ddeaa7492d4
BlackNET
c3cad420d5e8e63d11b2b00d198db8cdf12018ab7080f870b21e29f89a897868
BlackNET
cc5d048942af05983d2f2495d36c63164ac1ef6eeca86ce7835eae706dab476b
BlackNET
cd706f1f829de6745dbbbd89ee6297eacd015b18d2705dfa0ff89b6f9290467a
BlackNET
d238aea078ca1bb99a80ec2bf5d07acb818d72e7823ea8e767eefde95a038401
BlackNET
e867582a41582f52cea35afbb16184d282682e0aaa828e5ee9ea36f834b5bb13
BlackNET
fadcffc72696cb639334be446d2aeb90743b270276f48b730efbb59b73505a85
BlackNET
+ 22 additional samples on MalwareBazaar
Result
Malware family:
blacknet
Create hunting rule
Score:
  10/10
Tags:
family:blacknet evasion persistence suricata trojan
Link:
https://tria.ge/reports/210801-s8db7vccas/
Behaviour
Creates scheduled task(s)
Kills process with taskkill
Modifies registry class
Modifies registry key
Modifies system certificate store
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Deletes itself
Loads dropped DLL
Windows security modification
Executes dropped EXE
BlackNET
BlackNET Payload
Contains code to disable Windows Defender
Modifies Windows Defender Real-time Protection settings
UAC bypass
suricata: ET MALWARE Win32/BlackNET CnC Keep-Alive
Unpacked files
SH256 hash:
dce696122649ef915c08645cf53e6b118977ce476b076f72d00e3b6f3e309c77
MD5 hash:
d1082e6ae11fecd45ebe0f2b3d32230d
SHA1 hash:
c070a8395ccb984f5bcd8f22629ffa1b41ea14c1
Link:
https://www.unpac.me/results/8cbf5e32-eb0a-4932-ac03-5d2b5989dbe1/
SH256 hash:
6b69a8fd83ca150642a20128f84cdd2e91aaa6852e705e55e4116caa487903c4
MD5 hash:
7c011f0ea2387f0124c959e3f663cb4d
SHA1 hash:
12e668079661c557963236786bb821af4628ee1b
Link:
https://www.unpac.me/results/8cbf5e32-eb0a-4932-ac03-5d2b5989dbe1/
SH256 hash:
ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e
MD5 hash:
89dd6e72358a669b7d6e2348307a7af7
SHA1 hash:
0db348f3c6114a45d71f4d218e0e088b71c7bb0a
Link:
https://www.unpac.me/results/8cbf5e32-eb0a-4932-ac03-5d2b5989dbe1/
SH256 hash:
935f33132655ee0556f24677bdb57fb1f373549b29a179494093db98b36ff103
MD5 hash:
8f36b97bdf8122cc3acecf364ffdbe6c
SHA1 hash:
39689b059955e31903a9f566a74d3ec8706df38f
Link:
https://www.unpac.me/results/8cbf5e32-eb0a-4932-ac03-5d2b5989dbe1/
SH256 hash:
79243bc7d5809322d4bb6286496db1711b239a17cfacfb158c6a6e5b91e57bb5
MD5 hash:
67e49231a7da6e0665d2b6510f7932f8
SHA1 hash:
22fba7336a9a804b0607c5a05e708ac753f5f4cb
Link:
https://www.unpac.me/results/8cbf5e32-eb0a-4932-ac03-5d2b5989dbe1/
SH256 hash:
e6507f36045c13dee736bea44d61e90169ea69de61e9dc50b5743960c5b8f85a
MD5 hash:
97cb3fda3cff430377a866d6b437de8f
SHA1 hash:
2359c8459c1e1dd133c2842b51d2982e63016f92
Link:
https://www.unpac.me/results/8cbf5e32-eb0a-4932-ac03-5d2b5989dbe1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e6507f36045c13dee736bea44d61e90169ea69de61e9dc50b5743960c5b8f85a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/175523/

Comments