Extracted

• • Target
    Server.exe
  • Size 23KB
  • SHA256 a642b23358d9dafb9bf499669eba69230c01a66c63fcf7f50f6f517cd5216d46
  • MD5 7e538633ff4ce072f1b42ebac9f3d500
  • SHA1 36fa49f9fb7833072bec6fd763fbf4fde49371b0
  • SHA512 7a69908e4e1528c3c986dacc485777114d5079f4e0b3a748fd590fe86064648d8150842a469d8822d9bd8104d631ba057933c21a695f97ade301aa8686b0abf8
  • SSDEEP 384:/+n2650N3qZbATcjRGC5Eo9D46BgnqUhay19mRvR6JZlbw8hqIusZzZVMsc/:Ym+71d5bRpcnueMsK
  • TLSH
    T1D9B22B4E3FA98856C5BC177486B6965043B0A1470413EE2FCCC564DBAFB3AD92D4CAF8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitcredential_accessdefense_evasiondiscoverynjratpersistenceprivilege_escalationspywarestealertrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Disables Task Manager via registry modification

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2