Extracted

• • Target

    Game.exe

  • Size

    106KB

  • MD5

    f1137777be5beef3c2b15c4e6dab2dd1

  • SHA1

    2d97bc31df4308c85fcd05243448ad89c836f4c0

  • SHA256

    3be12c22cc954da3bde7d99a82deb9271ea87a10a3276daf569e3e291e6bc212

  • SHA512

    8509e989413f9d36a78012de28eda57e58f1f14f209f20f35706760efeeb9d846802a7f274000fdb7f3836f49f9b2a4c398437b0503f0e439bc5e0d69533ae6d

  • SSDEEP

    384:fg4sWrur+ibXr4TP4aJnSt3rFNO99Sjvb99SjvWp:fAuin4Tgc23r69Sbh9Sb

  Score

  10^/10

  njrathackeddefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2