Extracted

• • Target
    JOKE.exe
  • Size 65KB
  • SHA256 e00d04dcc4489101599f86df3956673c2ebcb8adbf05fb603266b91e9336b955
  • MD5 a85056ecfbf94af8efaa2e9dcec8ebb1
  • SHA1 f081275fbbdddad10689e185a750e1fd1ca0d0e5
  • SHA512 c510e21e4d5b2b8fb2e7e902f74a6befbe20896490e607d640a2611020f20cede1d154e894fde5be8a6a2e564d2d7eb6d741d9b3ef21cdbefc5abdbc6a056fa9
  • SSDEEP 1536:yw10jQoN36tKQviFw1ufGqBnvALfLteF3nLrB9z3nWaF9bJS9vM:yw10jQoN36tKQviFCe1BnAfWl9zGaF9Z
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bootkitevasionpersistencetrojannjrathackedransomware

  • UAC bypass

    evasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2behavioral3behavioral4