Extracted

• • Target

    FOXAUTO V8/FoxAutoV8.exe

  • Size

    17.1MB

  • MD5

    1d54a576355df6926a7a2ef43a91b316

  • SHA1

    26d9f73ceebb6e790d767d51921962e4eac9f8c8

  • SHA256

    96d5de118289d25d3b8fbacf542ec7357d3a6aae61f8c953a07347654bc4ebc2

  • SHA512

    67da0b995839413eef70247202c727e29c8635da21e234dbaf50ebc2311cabd86ff8931471811dc49b4e4eeafba79f1662cdc4281da51405ef97debf7e4bdf23

  • SSDEEP

    393216:m3szf490qL2Vmd6m5FTodIn+LH/+zVbJR6f5zCbrZDBXRFq9Lgi0Gyu:m3szfm0qyVmdjTbJR6f5CHZDBXPq9Lg2

  Score

  10^/10

  persistencepyinstallernjrathackeddefense_evasionevasionexecutionprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  behavioral1behavioral2