Extracted

• • Target

    Travel Agency.Exe

  • Size

    47KB

  • MD5

    317b3672b23e381f9a37d7d6ec884bb0

  • SHA1

    b4292272efafaa59a33c221302106fa0975834a1

  • SHA256

    34646a46c7823387ef84784c27a8ddbecd27172c2c0d7774142b6c3bb294105e

  • SHA512

    5c1b26880d93632b89ede918b4af690b2a2e536a15860ec0d6e0d4d4fbe1bc99f7bea291ab255e6d35d14082aaffd14786cb4ac6f73e303726f87af6577ac886

  • SSDEEP

    768:9dnB0tCj9AhsM5eCibbvyLzY1n9bcNr6KcHwRc3lxnDXV/+LaFjjUf/L0OHFfmMZ:RT9AFiPvyLsZ9bcNr6KcHwRc3lBFwOUF

  Score

  10^/10

  njratvictimdiscoveryexecutionpersistencetrojan

  • Modifies WinLogon for persistence

    persistence

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2