Extracted

• • Target

    383415F1B59A5B44074655ECF23D806B.exe

  • Size

    99KB

  • MD5

    383415f1b59a5b44074655ecf23d806b

  • SHA1

    febd2f81bfb9debb631160673f6bf5718cae0f37

  • SHA256

    47f20e39f51c71bbc24e7bf28496c859cf3e4e9dc81cc439f177956aba6d32a3

  • SHA512

    62a081357e5ef2b1cd8cb3d3062624a8192542fba3f1959a9a5ab17db0fbb5f2687244a99abb31ee9631c19d4134f3d1e5bc313f1c97de10ff1c4c13e028ab17

  • SSDEEP

    1536:09FUuRWzwFfsSMBdvueI5Xq8ZGAHEKJusRebSTr2qPQ2TYB+ezwRYx3beV5EKQLa:/MlDZGIuLS3TYB+eztx3be/EKyyFfai

  Score

  10^/10

  blacknethackeddiscoverypersistencetrojan

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Blacknet family

    blacknet

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2