Extracted

• • Target

    celex.exe

  • Size

    55KB

  • MD5

    059fd4cebd6fa3272a145fc6ef42f5f9

  • SHA1

    064b17bfc80151c060e2c2863390bcf7af90a467

  • SHA256

    5437080e89ca02f2de4f23eb66533155888bdbf257612326194f6de85a28b524

  • SHA512

    4c323cdcd21c10451f5345eeb40ac1b3ccafb80180d46bfc1e85bf40747d45481e649efafd9a01d79e8099cd1b65fba2138919ee9be282f94ecb4d0df2bcec79

  • SSDEEP

    1536:sEYADn8fLN2/SbJtDDcwsNMDpXExI3pmmm:+ADnccqbXDDcwsNMDpXExI3pm

  Score

  10^/10

  njratcredential_accessdiscoverypersistencespywarestealertrojanupx

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1