Extracted

• • Target
    Havij v1.18 Pro.exe
  • Size 5.2MB
  • SHA256 112292cdc9d0c9a68ce1cdc88e85541f83519181fdef4e27ffb7fe984ebc6458
  • MD5 33693e148bebc3c5c83a1ffd21541082
  • SHA1 d445ca7ee0fe08f88001852fd7d758a2ed1a8d74
  • SHA512 ea89517c970c615c860c8f56abe9381a184ca9428de42c0bcbdaeba7ab17704d6a03844d26f868de71ca3a0cf2d71092b6dd440cec51581a7de4a92a40e8e291
  • SSDEEP 98304:y1dl23VmUY+dONb5EzrMM+t5SY+rc7wjNHVrwqEzCKYdHrVOA/fO6oyHTpSgsU1p:0UY+dk5SOcLrfhHV01+HpOqfO6oyzpSc
  • TLSH
    T1724633D3B3C94899F0A16ABB68734A3F10B9EE6C9F250D92C71DF7161E30058979528B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebootkit<<_h4ck3r_am4zighs_>>defense_evasiondiscoverynjratpersistenceprivilege_escalationspywaretrojanupxvmprotect

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    defense_evasion

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1