Extracted

• • Target

    024374fd9a1ccb89cd86797a75558c252ad8d1fd9ed780d356aa1343310c2efdN

  • Size

    70KB

  • MD5

    064fe6e7b5a1efa16117088e021e2960

  • SHA1

    3366017eb2314abac07db37553bbe0a5c69c357c

  • SHA256

    024374fd9a1ccb89cd86797a75558c252ad8d1fd9ed780d356aa1343310c2efd

  • SHA512

    12e794d42fa15f5334c87091ffa4b838fa76a2976142cc6f8cbd3b1bea4b2c9e61f537cb2db451f78bb5252e40ecb6c0bd41edde9cbfd39c1b8d62b3ecc54307

  • SSDEEP

    1536:gFTnqpKxynVVGeifCSzTPb542HkLbvJfxa:gFTMGeifrvb59H+bvJ5a

  Score

  10^/10

  blacknethackedpersistencetrojan

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2