Extracted

• • Target

    90071cffdfe6465b764829a706fe27f1abbb58d719bfcb428b210ae8c939a320

  • Size

    228KB

  • MD5

    e12000b9b526a5caff5b13d2cb2d07d0

  • SHA1

    7f9227195996aac1d27b38d5b95a837e8c2b43c2

  • SHA256

    90071cffdfe6465b764829a706fe27f1abbb58d719bfcb428b210ae8c939a320

  • SHA512

    a506b0e76e72cf2e4f92e60c12ac4cee7aedcca37e3aa6c71eb3150438363122e4e880608cfde334c51de4aaf9e5677d5a7b353f1fb3ef49741ef9a3467a2643

  Score

  10^/10

  blacknetmicrowavecoreentityevasionrezer0trojan

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET Payload

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2