Extracted

• • Target

    BootstrapperV1.34.exe

  • Size

    866KB

  • MD5

    21724e0b24754244b7e43f20a132c7db

  • SHA1

    da582b5d7da1743b89a243428c67a9fbd37fb21f

  • SHA256

    dd05afbc110940d656d1af4c5a16542a636e0234941ae74ccb1d35d48f950b55

  • SHA512

    0b193250c40ff4d0936a711194173e77f12063e1e3c0a348c773fa9393511b3a3db6e9f68ad5d146d25bdb0bc4d21ab133a53672c6c4d672858054fb439c02ea

  • SSDEEP

    12288:d0zVvgDNMoWjTmFzAzBocaKjyWtiR1pptHxQ0zzA68:e5vgHWjTwAlocaKjyyItHDzUd

  Score

  10^/10

  njratveletrobloxdiscoveryevasionexecutionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2