Extracted

• • Target

    1166d07b07dc76f3cc61516d748fa92c8945ac3a4c1bba10e11dc131d5e83001

  • Size

    80KB

  • MD5

    3b440d464214b9772f31ba984779101d

  • SHA1

    be42c86a1fdbcae03f24ce81bfa1944dcccaf5c5

  • SHA256

    1166d07b07dc76f3cc61516d748fa92c8945ac3a4c1bba10e11dc131d5e83001

  • SHA512

    6f49a18427669f7a9ab2e503b409d6377f5b92d3b070934e93df67f817b17745ccf79d421edd2e69f31b4e2675339bf63daf87e4ce2d93556f09d66dfe2f15c4

  • SSDEEP

    1536:dPvK/3zvzVQtCsscKvWyjzJxuOmb54vHTL6lm:diqCspEzVmb5uHv6lm

  Score

  10^/10

  blacknethackedevasionpersistencetrojan

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2