Extracted

• • Target

    d5dc32b543a9571c6dd027018eb41868df7bd0847269407bfb7ca029f2b290b2N

  • Size

    80KB

  • MD5

    2d365a835420a9de141125860bbf4070

  • SHA1

    9f5c40351f7f452137e1b3ae0fde9c0fc56174b8

  • SHA256

    d5dc32b543a9571c6dd027018eb41868df7bd0847269407bfb7ca029f2b290b2

  • SHA512

    1be6956eb46a6f617badb7ee243637f2708a381542470173f5d7be52132965095f1d93c1df51c219024cbd01c26386d489311efcdab09ea32d051b92d844ac7f

  • SSDEEP

    1536:dPvK/3zvzVQtCsscKvW1jzJxuOmb54vHTL6lm:diqCsplzVmb5uHv6lm

  Score

  10^/10

  blacknethackedevasionpersistencetrojan

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2