Extracted

• • Target

    YE.jpg

  • Size

    1.9MB

  • MD5

    db00d76d920d8d9e1a01a0d278d64f0f

  • SHA1

    321535469be98ff53be76621c10027ab0d14bc15

  • SHA256

    806fb0b10366bb1923a9d4e4545ab76d589a1848eb758c978bc349ca86b22c54

  • SHA512

    86950248bed2ad1199d9ded6f74318fe86ee52af99b420dff9101839c9757f816b7629b251fcd867078082a3db48deeb8a1925b2ef73dd0ebae646bac4a62676

  • SSDEEP

    49152:pzMD+O974EJW3DyQFXC2p1WuO9WYFNmPR4X50IepawQWAs:pzMDXCiQXFhytNwc50pawQG

  Score

  10^/10

  blacknetredlinezgratggdiscoveryinfostealerpersistenceratspywarestealertrojan

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect ZGRat V1

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Contacts a large (2353) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery
  behavioral1