Extracted

• • Target

    48e2df0cd1b612a2cb915ebab3f8259f208d9cd4318c4944375fb968bec37321

  • Size

    70KB

  • MD5

    05f33f33b292bc0f0027444815a52cbb

  • SHA1

    8c85482965be67e2854d072c1e0be99c653f1f3a

  • SHA256

    48e2df0cd1b612a2cb915ebab3f8259f208d9cd4318c4944375fb968bec37321

  • SHA512

    e430efed5114668cf9adf5a1039655ed98ca3abf9188c703f8ec314f5050afee50f1e1799d17673a9e457cdbbc8259f41309d3a1844ae04e1c291cd165d953cf

  • SSDEEP

    1536:gFTnqpKxynV4GeifCSzTPb542HkLbvJfxa:gFTlGeifrvb59H+bvJ5a

  Score

  10^/10

  blacknethackedpersistencetrojan

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2