General
-
Target
84298E0B46665AD3825B9344FBDA6AC8D75A6E9CCC44E.exe
-
Size
86KB
-
Sample
230324-st63gahd3z
-
MD5
ad9e6ee16b3abd3f757c8b5357de6042
-
SHA1
f324263dc0b46991bb0ed664577910c4f4de8009
-
SHA256
84298e0b46665ad3825b9344fbda6ac8d75a6e9ccc44eab5b40a70555e4718f4
-
SHA512
428453f17a3c7829e8d6719fb605439ac26368be25113c179af2fa03e2b064e523eae1043998d54dd5ce07626012c43ffede666dec431013183eef990e0d8235
-
SSDEEP
1536:zW27RutYPWEBQlIGOO1g4W6j6hMbv4UFZLrkjj1RZ:5g1g49jcMbvLFxrkjF
Malware Config
Targets
-
-
Target
84298E0B46665AD3825B9344FBDA6AC8D75A6E9CCC44E.exe
-
Size
86KB
-
MD5
ad9e6ee16b3abd3f757c8b5357de6042
-
SHA1
f324263dc0b46991bb0ed664577910c4f4de8009
-
SHA256
84298e0b46665ad3825b9344fbda6ac8d75a6e9ccc44eab5b40a70555e4718f4
-
SHA512
428453f17a3c7829e8d6719fb605439ac26368be25113c179af2fa03e2b064e523eae1043998d54dd5ce07626012c43ffede666dec431013183eef990e0d8235
-
SSDEEP
1536:zW27RutYPWEBQlIGOO1g4W6j6hMbv4UFZLrkjj1RZ:5g1g49jcMbvLFxrkjF
Score10/10-
BlackNET
BlackNET is an open source remote access tool written in VB.NET.
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies Windows Defender Real-time Protection settings
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Windows security modification
-
Adds Run key to start application
-