Extracted

• • Target

    d418fb498d89dfecd659adf5c5b6c7531c7b53331b37a420820b0236e1f86afb

  • Size

    70KB

  • MD5

    5988d7b07aa7c5c36dc0420a313bfb50

  • SHA1

    d9f9b25cde6904c0daa6a7461973cee950c1af6e

  • SHA256

    d418fb498d89dfecd659adf5c5b6c7531c7b53331b37a420820b0236e1f86afb

  • SHA512

    62f2fbfa860071d6839d207bc49338ed5e74e7e99cfe372c416ab7f69045529f7a9c4c8f0adf099969c59b71ab869d8145ee53307131fe52faafaaf03048b8fe

  • SSDEEP

    1536:gFTnqpKxynVhGeifCSzTPb542HkLbvJfxa:gFTAGeifrvb59H+bvJ5a

  Score

  10^/10

  blacknethackedpersistencetrojan

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2