Extracted

• • Target

    c2504b5ea5090f360cfcb1ffd988a9f1d7e47e6c307cae723d9f0973ae6a867eN

  • Size

    70KB

  • MD5

    5044c3d39f40ed3e2d60a5aaaea4d1b0

  • SHA1

    ea14e3eb23a42f487265e75f411bbd4e244011ef

  • SHA256

    c2504b5ea5090f360cfcb1ffd988a9f1d7e47e6c307cae723d9f0973ae6a867e

  • SHA512

    de1db4be26be183e62a95c2d053d1a796d37a2a5a0e374ce421b9ad22ca7b52f65544d027b2086b9b50d365c96e9660ff3c1517f1197109c71caeb3cee5f8fc3

  • SSDEEP

    1536:gFTnqpKxynVCGeifCSzTPb542HkLbvJfxa:gFTzGeifrvb59H+bvJ5a

  Score

  10^/10

  blacknethackedpersistencetrojan

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Blacknet family

    blacknet

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2