Extracted

Extracted

• • Target

    sostener.vbs

  • Size

    1.6MB

  • MD5

    8476643328f5fd81e1144a3f9b340a7f

  • SHA1

    2b07f0425c5ac7a7b8ac33f903780d740769e92f

  • SHA256

    3f15c83a041604541d777c6837797d4b28196f3a6926375324a2dbfb993823c0

  • SHA512

    abd50137cea3607d8535eef8cda4f20e0cfa77c533468b48c7af443bbcc13a0f60e5813c08919eeb2786f4634e7bbec8013f0fb8057424e9e4659abafd2a046b

  • SSDEEP

    192:9PmPPPPmPPPPPPGPmPPPPmPPPPPPGPmPPPPmPPPPPPGPmPPPPmPPPPPPGPmPPPPI:V2GsBchF2lK

  Score

  10^/10

  executionnjratnyan catdiscoverytrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2