Extracted

• • Target

    New Client.exe

  • Size

    65KB

  • MD5

    1bcb0ce08d34ba620819df0268e04011

  • SHA1

    296765a47aa584a24bf66ddc9e67356e3203fac8

  • SHA256

    ba67f398fb2c5f91c1c227725fec68eba38a9f6c81a425450baf1b94037fe77e

  • SHA512

    f3409246d7cf16d9902d3420f6e5048e87859484e85a25eebc4559ddc6d26e9b40843b78b3a056c24e1bd9efc13d609f1a9ef37387789cb6994b84c7e4bd0145

  • SSDEEP

    1536:MKqK4Tm4BoN36t4QviFw1AjHkBnvAffLteF3nLrB9z3nIaF9bXS9vM:MKqK4C4BoN36t4QviFC8EBnYfWl9zYab

  Score

  10^/10

  discoverypersistenceprivilege_escalationnjrathackedtrojanbootkitevasion

  • Modifies WinLogon for persistence

    persistence

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2behavioral3behavioral4behavioral5