Extracted

• • Target

    eecb4035c620f07749f4627e6c7243dd4053b4918c6d76e236374900d0dace3b.exe

  • Size

    195KB

  • MD5

    d867a6939e03ff1ccf63605dddea632e

  • SHA1

    b04f4689ac1ecd317387b28fad290f15a68878d9

  • SHA256

    eecb4035c620f07749f4627e6c7243dd4053b4918c6d76e236374900d0dace3b

  • SHA512

    28a848f5411c8af9e046ff37507f96da84790bdaf140fbae1526ce980cb0142d47f957de3a3f1a36a6a12c6e32c28f6706f06d770e4948a6ae3f74c3c628fba2

  • SSDEEP

    1536:eZuhD5z28TC2PBttWjm38hPMsCoTgbSUPH4Lksi9WXU+pOk+G8wb/APcz+tBvqtu:7pmjm38QegbSKHanO1wbClvmYlVfm+

  Score

  10^/10

  blacknetwindows updateevasionpersistencetrojan

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Detects executables containing artifacts associated with disabling Widnows Defender

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2