Extracted

• • Target

    9228D8C44CDC5CC4D82EC3FE68379C6C5938BC04702CF.exe

  • Size

    6.2MB

  • MD5

    cc95e0f6886ee79017f070ceedbb17e3

  • SHA1

    e628e3331228741760644b0716b6e66f7a37324c

  • SHA256

    9228d8c44cdc5cc4d82ec3fe68379c6c5938bc04702cfc86b9b8c96872b52a68

  • SHA512

    f50b798226c81db56187e59b258d2e857dc28da6cb42a047e0ffb5da2dc4c95f68d3d8788cec8a15635718a345d98f8c2c5e579101cbd88493e2d4805d7f5136

  • SSDEEP

    98304:u5hHwzlKTDbdRGQSxUTZeNEiIK176ykGlnrHL21sHHLrHIatQts6mughHLo:uwzoTDp4QeUpg176KlnrHiGYDdmughH

  Score

  10^/10

  njrattaurusbatvoievasionpersistencepyinstallerspywarestealertrojan

  • Taurus Stealer

    Taurus is an infostealer first seen in June 2020.

    trojanstealertaurus

  • Taurus Stealer payload

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2