Extracted

• • Target

    SQLBOX.exe

  • Size

    8.0MB

  • MD5

    79f7442af52bd4ce3ccc1894d4841d16

  • SHA1

    ec752f917e4043aa27a49a5282e9f9d4f538829f

  • SHA256

    29551a26f72fa6c387909b88ffcad535db08f17e0b62781478a0097070f48dde

  • SHA512

    972ebfca52b010df791ddef879f312133f7f11e3e63b4096cf901ba6203b244f9e8a3a37e9055d437476bc54931e68763369fb8c1f6fc900ab60e452fe149cd1

  • SSDEEP

    196608:jp8UI0VdmlV8ld98BlON2jnbNswvBXvowJgzl7GSZn7ftmcg:lJPmy90jVvBXvoww77rccg

  Score

  10^/10

  njrathackedevasionpersistenceprivilege_escalationthemidatrojandefense_evasionexecution

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Modifies Windows Firewall

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2