Extracted

• • Target

    NocturneLoader.bin

  • Size

    607KB

  • MD5

    4a5b7c6a9592dd295c6c23c6b17eae92

  • SHA1

    538654fa1a9453483ab2d051fad9dfe38cfa2b3e

  • SHA256

    4c3fad8ea837861fe54356ad6e7e40cce2fe305b9cb323f07d8802c93a440b70

  • SHA512

    47144a0eac75fb8a4653644441c8f3805e98cf82e681e89288603497ca44b2a43e1c3e794171113bd8744bc712cef31578f0e4f8e54ac029f9613531820ec248

  • SSDEEP

    12288:Cs13XpHNz+8cbkAklsOnb7Ev812q94GEwX/E+:b3XbzzculsObQva91DX8

  Score

  10^/10

  njrathackedcredential_accessdefense_evasiondiscoveryevasionpersistenceprivilege_escalationspywarestealertrojanupx

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1