Extracted

Extracted

Extracted

• • Target

    DF15669F7F948ABD95D1A4C326AA0443F0CC534513B25.exe

  • Size

    451KB

  • MD5

    8eb05c68a5880d8f15fa787b02192709

  • SHA1

    45813931de14ac2f4f66d412caf9cf6fd236c5c5

  • SHA256

    df15669f7f948abd95d1a4c326aa0443f0cc534513b253accff8bd2549a3f3dc

  • SHA512

    231d122c647684386399ebe117189f1d784f89ae127fb41a061b6d43bec94c7d9cda0f13b6a4ad7f1ad233177f9df43a11c6040180653bf592ee39d3e74708b3

  • SSDEEP

    12288:BjKiWwykMpBMs3qLVmNwCIWaONK6ezkf4BBe/wKA3JIOb2:Bj5bMpf6L2wzWnW38zA3Zi

  Score

  10^/10

  persistencenjratwshratofisstrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2