Extracted

• • Target

    05a76fef7c417236dcbb43e4624dc57876a2aff8b9c8bbe16c87f3810b158a1bN

  • Size

    80KB

  • MD5

    bf4edd976fcf5289e7c2531ef3ce69f0

  • SHA1

    c255da8598c17b23da2ad842808ea5e6f03dacd8

  • SHA256

    05a76fef7c417236dcbb43e4624dc57876a2aff8b9c8bbe16c87f3810b158a1b

  • SHA512

    6266415f3088061322077112030397c45544f96938f59ecfe7e26f0c481e15643569b8945a82c7e8a45387cc10c160ad0e9c1e51e27bf0836110723671bd9211

  • SSDEEP

    1536:dPvK/3zvzVQtCsscKvWUjzJxuOmb54vHTL6lm:diqCspazVmb5uHv6lm

  Score

  10^/10

  blacknethackedevasionpersistencetrojan

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2