Extracted

• • Target

    Caffeine AIO V6.4.exe

  • Size

    16.8MB

  • MD5

    778a18e01b13cf3bded3b404dd082477

  • SHA1

    0e69f43e8b62bd6a7a5f53ff01fbbdd5719edabd

  • SHA256

    53ba48a952c4fe5731cc72d46ad812a5361912d6ba7e814d514080084b98d1f6

  • SHA512

    432b4907ac377820aa171c0b68b4d5057c9a46e43edd6b2278bc9017545dde117a542dbe6161f02e83764959a2efd3bc4919cdb8f538eb5958dc2792a8797dfc

  • SSDEEP

    393216:6i4DMnBpAsJ/smgUon4yf77fox8MuHuVe+at5:6i4gfAsJ/lKf7LrhOVCt5

  Score

  10^/10

  njrathackedevasionpersistenceprivilege_escalationtrojandefense_evasionexecution

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2