Extracted

• • Target
    YE.jpg
  • Size 1.9MB
  • SHA256 806fb0b10366bb1923a9d4e4545ab76d589a1848eb758c978bc349ca86b22c54
  • MD5 db00d76d920d8d9e1a01a0d278d64f0f
  • SHA1 321535469be98ff53be76621c10027ab0d14bc15
  • SHA512 86950248bed2ad1199d9ded6f74318fe86ee52af99b420dff9101839c9757f816b7629b251fcd867078082a3db48deeb8a1925b2ef73dd0ebae646bac4a62676
  • SSDEEP 49152:pzMD+O974EJW3DyQFXC2p1WuO9WYFNmPR4X50IepawQWAs:pzMDXCiQXFhytNwc50pawQG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  blacknetredlinezgratggdiscoveryinfostealerpersistenceratspywarestealertrojan

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect ZGRat V1

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Contacts a large (2353) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery
  behavioral1