Extracted

• • Target

    620a2009c1e6c41da1e8afd565494956609883a1838d014d844a7fd24860d728N

  • Size

    80KB

  • MD5

    2c7e09eaa095241bd7f879a97e5e9dd0

  • SHA1

    042a40bf2076761dd4a6106761a99e65e0ede677

  • SHA256

    620a2009c1e6c41da1e8afd565494956609883a1838d014d844a7fd24860d728

  • SHA512

    49ebc78563e367252548613771d195bbd075507b8be990e94526112e4a55fa63fc8d4779d819992a848a914245ea5c17dbf6ab7779369c2fb4095cb1bc79c57e

  • SSDEEP

    1536:dPvK/3zvzVQtCsscKvWPjzJxuOmb54vHTL6lm:diqCsprzVmb5uHv6lm

  Score

  10^/10

  blacknethackedevasionpersistencetrojan

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2