Extracted

• • Target

    New Client.exe

  • Size

    188KB

  • MD5

    b848808a7c3f542eaf9718c0c8e0159f

  • SHA1

    c8fc1af2a0e6df1be9426b5f2e636b7f2b1aa302

  • SHA256

    13fde5c8aeb2fe2335dcb803a1a31a404e2f65e990d2a728a0df681ef832b616

  • SHA512

    0eb66a47448b588cdbd4b1b1d426c70b10fd073f2612a1f45e3abbec7b61f35735ff2a8cfeb1eb3f5390f89cc3abd88522a1c7ff20ddc8857242e8ce7335ac2d

  • SSDEEP

    3072:p2B+64kQ2EJam2dNREz9Vnc4OZMJwGu3U4QyZom8exsrPR5TE7D0XuDTTo6M//lz:p2B+64kQ2EJam2dNREz9FdOZMJwGuE42

  Score

  10^/10

  njratantiviruspersistencetrojanupxbootkit

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2behavioral3behavioral4behavioral5