Extracted

• • Target

    d4e4cf8c41bb1577b18afd03749b5ea4b575e24051714e55a97c008ddc678dd7N

  • Size

    70KB

  • MD5

    653f8b08a619a7dcb179de3411735320

  • SHA1

    8d5e8d215e7f78d5a2f9a63b78f6e4bc71133db0

  • SHA256

    d4e4cf8c41bb1577b18afd03749b5ea4b575e24051714e55a97c008ddc678dd7

  • SHA512

    680f179aae9f52d5a8880766713298e3bcde96a16a06ef9b0b1b45d3d7fda085636c3f0e656b359d65f7729f52f6b08d40d5dbc14476efb326be9ce70fab4b82

  • SSDEEP

    1536:gFTnqpKxynVBGeifCSzTPb542HkLbvJfxa:gFTQGeifrvb59H+bvJ5a

  Score

  10^/10

  blacknethackedpersistencetrojan

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Blacknet family

    blacknet

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2