Extracted

• • Target

    MoonHub.exe

  • Size

    55KB

  • MD5

    d33c25da94cb95d1e34f9d22cfd51f99

  • SHA1

    b0e82ba0f916dd2e104e612c9a5dc73a96a7b2e1

  • SHA256

    f434f44ae7c461b9f88f955cc0977cbf0ae163267b38b5e6ad7989dbcc2d5047

  • SHA512

    460d29f349edf87720b4841bbbd5f8c9b63c81b11d893b9625622ef5912e1f6ded6c85fbe2ed670a31788df9eb4c1d149994cc14f23413d62023e51a2b30e5e1

  • SSDEEP

    1536:V/pMDnE4uNRty4XzPhhDVwsNMDHXExI3pm+m:rMDnlYk4XdhDVwsNMDHXExI3pm

  Score

  10^/10

  njratniggerdiscoveryevasionexecutionpersistencetrojanbootkit

  • Modifies WinLogon for persistence

    persistence

  • Njrat family

    njrat

  • UAC bypass

    evasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2