Extracted

• • Target

    3306408888aafd826db9c4cdf7d2aeb587b8a667cc24115e93621f2cb9872c12

  • Size

    70KB

  • MD5

    1233eb5bada76ccd62168d01e03f95de

  • SHA1

    0bf38b1d8c1408362317e8c30ac8eb77b2360e0e

  • SHA256

    3306408888aafd826db9c4cdf7d2aeb587b8a667cc24115e93621f2cb9872c12

  • SHA512

    bc63aed77f7b37389f5ee7652491fe9e24a2e50a04dc3d0c314905b32f301b88d1d2160c70658bd30a5e4d02451f637e2e4ad7b96d54b36f05efadf2e5768f30

  • SSDEEP

    1536:gFTnqpKxynVcGeifCSzTPb542HkLbvJfxa:gFTlGeifrvb59H+bvJ5a

  Score

  10^/10

  blacknethackedpersistencetrojan

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2