Extracted

• • Target

    x4.exe.bin

  • Size

    54KB

  • MD5

    f01403f4fc9c0727876a46568faee2a5

  • SHA1

    1323d3cd7517b50a52f774024af682decf3c3698

  • SHA256

    48f2fc5866fcc8d9c02674e7fcb6e46f82aa94ccef260a885205c537c3a3ca44

  • SHA512

    99c6fdd4aeadb54e699a2ef628b2c1e44c9bd02c031399dd9d62e1c256e974829668b0cef33c84493dc6fa83bd0ab70eabf975b89b58cdce6aa21650e2d56cef

  • SSDEEP

    768:gVXZuIZ2Eslt0g5X3SY3qZJSNDxWQG35bmaePD5Pvp2XXJdxIEpmag:gVB1Gt0g5SYSG9WQcGDYX3xIEpmag

  Score

  10^/10

  njratvictimcredential_accessdiscoveryexecutionpersistencespywarestealertrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1