Extracted

• • Target

    BAA73A9B35BF02D8C56A1286BCD2D714.exe

  • Size

    1.1MB

  • MD5

    baa73a9b35bf02d8c56a1286bcd2d714

  • SHA1

    a179259548f9e81b65126130342f5b076c8b8a77

  • SHA256

    14490c9c139e9bc984781f8143a571e1f1f140c69a7cd12c34fc0bf20abb0889

  • SHA512

    02f75dafbd6cabc107fd681d0cc65991b0a21b16b713fba77db4928e78f1da23474ddb4535f8280dc56186da90e41adc7ad8b10ffde2d0b18ff494273021d644

  • SSDEEP

    12288:DCwHtUz0qTqcXrwV+XinIBLAx9gKupscZ0PpHTzY8QGWlCL8K7XLlq95ZPFdmUG/:DCwHybsV/IOv6scZ0BzUfCz3+zsw8YS

  Score

  10^/10

  blacknetzgrathackedpersistencerattrojan

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2