Extracted

• • Target

    b3bf3ec23cae1f14bb3b014a90f74259912cf550b012901b49c5440d9fc868d5N

  • Size

    80KB

  • MD5

    9bd589ca18efe19dd1c0fd088118d090

  • SHA1

    8c2b612bce8a42b6c61ea3c14aba501cd30f29cb

  • SHA256

    b3bf3ec23cae1f14bb3b014a90f74259912cf550b012901b49c5440d9fc868d5

  • SHA512

    af06fa63fe272c20f24ceeb894c2fda1f7abbba5fc16baaae0686b893aa8d3aea785a10c7fad7a0182e4569c83f2ef19450f9edca599269eef544b155f5255d8

  • SSDEEP

    1536:dPvK/3zvzVQtCsscKvWjjzJxuOmb54vHTL6lm:diqCsp3zVmb5uHv6lm

  Score

  10^/10

  blacknethackedevasionpersistencetrojan

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2