Extracted

• • Target

    9cfd629d245d36243638732f9ab3d3ff97817ccb6c3f1f906762b21a2e7e2d29

  • Size

    80KB

  • MD5

    06b787981a537662f649ec873167fb71

  • SHA1

    36c170af86855312eb4f152b37d959658f3933e4

  • SHA256

    9cfd629d245d36243638732f9ab3d3ff97817ccb6c3f1f906762b21a2e7e2d29

  • SHA512

    55c3b7a5209200da4819ac75607f3e26a05cb9956b5f7087762e53f7718120abf7343dc63ae3c059c5da54ebc4daea7764a383ecfd1e020a271ad435d3e950fa

  • SSDEEP

    1536:dPvK/3zvzVQtCsscKvWijzJxuOmb54vHTL6lm:diqCspUzVmb5uHv6lm

  Score

  10^/10

  blacknethackedevasionpersistencetrojan

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2