Extracted

• • Target

    Cracked_wave.exe

  • Size

    26.0MB

  • MD5

    9330b25f7ac3eb34a5f5b8f724e9cda1

  • SHA1

    29853b957e4b073f83f25fc7b333a4fc262792e3

  • SHA256

    b4dbcee5210537d5ec0a232990fccb8018bf898c88636849e6fc4bb38de62436

  • SHA512

    c3fdf6114fc370d8db27091f1e4b3e19fc123e05bbba3b1f96c748d25bacccb8b32f2da9a96141a7b6af524a66fda67658aab5aa75f93fdb29031a43bc7a885d

  • SSDEEP

    786432:B7zjkRQo93SGLxRIHn6MX52t7wQepJ1kNXXjh:WmsD1M6O52tRev1k1Th

  Score

  10^/10

  njrathackeddefense_evasiondiscoveryevasionpersistenceprivilege_escalationpyinstallertrojancredential_accessspywarestealer

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2