Extracted

• • Target

    babv.exe

  • Size

    29KB

  • MD5

    85e61aaafe402f7a04e793a53288a072

  • SHA1

    e8d088224025f54c58fa11e8b9835fa7dfd3b9ff

  • SHA256

    a7ae40544682a27bb1837c0c5d99f417bb4b8e8036e851529fe49a3d507a570b

  • SHA512

    cbfd7413fa3373e4c947c35b9605c1dade7159de0990f0961eef2bc4e2dc5e06b2e8cef974f9ada76951732a74d715c84d22e58c7dd1a841eab0e3096cc36511

  • SSDEEP

    384:tBs/hl7b1/JEI+GPWrb5hFEaemqD6CLeQTGBsbh0w4wlAokw9OhgOL1vYRGOZz/L:t47bXEI+GevhEsqdLe3BKh0p29SgR5d

  Score

  10^/10

  njrathackeddefense_evasiondiscoverytrojancredential_accesspersistenceprivilege_escalationspywarestealer

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2behavioral3behavioral4