Extracted

• • Target

    5afd70d54cc4af7f236894d674842493

  • Size

    776KB

  • MD5

    5afd70d54cc4af7f236894d674842493

  • SHA1

    6565657adebd3063ba85886e551e551b0bbd6fdb

  • SHA256

    8b79e79f75578ab62d83e89b6bfaf5404fa868041b880995579f3cd6ae6f995e

  • SHA512

    6fa7daafcd661d873bae7e092fab5c89f8a56978003d31b3b91eabc735e50ecc01b8e90f90fbcec193c0656f134b6ce69c98825cfbaeaa07a536ddc5eea641fa

  Score

  10^/10

  njrattaurusbatvoievasionpersistencespywarestealertrojan

  • Taurus Stealer

    Taurus is an infostealer first seen in June 2020.

    trojanstealertaurus

  • Taurus Stealer Payload

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Loads dropped DLL

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2