Extracted

• • Target
    Ventory Cheats.exe
  • Size 19.5MB
  • SHA256 11c3cedece6e2ca0c3a3d3d82449c9cc6517775373f396598c1412ad27922bf5
  • MD5 e200da864f43fa9f1fb1d60a8766b08a
  • SHA1 fb01291ddbecd751b0c69809add3a22d0675a034
  • SHA512 d20c713cf4f94adf78623f8c6e90a20b94f96248bf766658206f73b3e39a6dc884c8b5bc8e27113df91cc3285f58e52bdcce12be9693a1d102012c0ef84e1bb8
  • SSDEEP 393216:398zP/WBJ5ZaLoK/DNbS/MFqy4rY14Kg7Mdd2j5G1bQweyDsbqiFuwcFg+O9dK2b:t8zPY94oENbEiqfk4Kg79ByDszFhcRO/
  • TLSH
    T14527337742A6048FDBCC097E12CC8304D328BBA3D65AD9C5EFA81E0B3E19E65C276755
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hackedcredential_accessdefense_evasiondiscoverynjratpyinstallerspywarestealertrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Indicator Removal: Network Share Connection Removal

    Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2