Extracted

• • Target

    abf8775ca0867143edf0e265ff5023e46993ed1fd12ab5d1213a932d10322f35

  • Size

    70KB

  • MD5

    3fce760c2d0b38e2922b19ed2b870edb

  • SHA1

    d096fe45bced0c5a36d6fd65e3134c5b76f62b5c

  • SHA256

    abf8775ca0867143edf0e265ff5023e46993ed1fd12ab5d1213a932d10322f35

  • SHA512

    1fa91cf52569f24b3f8382390c3c54719249fe5aaacd432b5bb4e123775dc9d3f43cb399e17f2c83113ecc5554104af6ace2116917187f709859789ffc4370f0

  • SSDEEP

    1536:gFTnqpKxynVLGeifCSzTPb542HkLbvJfxa:gFT+Geifrvb59H+bvJ5a

  Score

  10^/10

  blacknethackedpersistencetrojan

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2