Extracted

• • Target

    272b706925733fc429dafefabbde24a1

  • Size

    6.3MB

  • MD5

    272b706925733fc429dafefabbde24a1

  • SHA1

    c6dc4ed69a7ea66c0b5c4b620f8f49e8d0ab277f

  • SHA256

    44d54e64683ebb67eaea413e15112b44c884e940fd74428c04288f2fd9a34980

  • SHA512

    5ddb8f1ef55c172d3ce46cb321bed3dc7aafa94e0a7b588cd956c93218c5adcde05171026686f635233f746953cdbea0d258f9d53c3a406f27e569045a2d42d2

  • SSDEEP

    98304:bF5An3/7s3wTmef6S7Q6oUQfO+JVaYltSEg96QxTxqVIvrjM:bFE3/wgTVB7QjUQfb/bg96QxlaIvrY

  Score

  10^/10

  njrat566evasionpersistencethemidatrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2