blacknet | 2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbb | Triage

Submit
Reports

Overview

overview

Static

static

3

2d513ec010...bN.exe

windows7-x64

7

2d513ec010...bN.exe

windows10-2004-x64

Sharing

General

Target

2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN
Size

10.0MB
Sample

241104-y8yyaswlcx
MD5

4fbba071325c9b47f7b39ee15c2feb00
SHA1

84df9706705d3c0229e0c9aeec662db2770132dd
SHA256

2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbb
SHA512

54e67f7c5107386fdbcdc2691499e77f6ede405629687da5e8d70ed77426bbd6ba5208e2e945755030e5e5a0cc33402431c9b50f837e953e5c8d127a92a5f163
SSDEEP

196608:iCjV2NBODPzMsVerPYVnN/SMFmxA1HeT39Iig6Tet4Q4G/NsIdyzWdAMYI93:3V2fugPYVnNSMF1+TtIi1S1NsIUzWdAQ

Score

10^/10

blacknet persistence pyinstaller trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN.exe

Resource

win7-20240903-en

windows7-x64

2 signatures

120 seconds

Behavioral task

behavioral2

Sample

2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN.exe

Resource

win10v2004-20241007-en

blacknet persistence trojan

windows10-2004-x64

13 signatures

120 seconds

Malware Config

Targets

- Target
  
  2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN
- Size
  
  10.0MB
- MD5
  
  4fbba071325c9b47f7b39ee15c2feb00
- SHA1
  
  84df9706705d3c0229e0c9aeec662db2770132dd
- SHA256
  
  2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbb
- SHA512
  
  54e67f7c5107386fdbcdc2691499e77f6ede405629687da5e8d70ed77426bbd6ba5208e2e945755030e5e5a0cc33402431c9b50f837e953e5c8d127a92a5f163
- SSDEEP
  
  196608:iCjV2NBODPzMsVerPYVnN/SMFmxA1HeT39Iig6Tet4Q4G/NsIdyzWdAMYI93:3V2fugPYVnNSMF1+TtIi1S1NsIUzWdAQ
Score

10^/10

blacknet persistence trojan
- BlackNET
  BlackNET is an open source remote access tool written in VB.NET.
  trojan blacknet
- BlackNET payload
- Blacknet family
  blacknet
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

blacknetpersistencetrojan

© 2018-2025

Terms | Privacy