Extracted

• • Target
    8924a1fca4f30edf90d7bc4303d0248d6aa58580386e23d1387dc1e85f4d7162
  • Size 640KB
  • SHA256 8924a1fca4f30edf90d7bc4303d0248d6aa58580386e23d1387dc1e85f4d7162
  • MD5 2950855d2e770a4bbb4cb5d776487809
  • SHA1 1b713072c1679665f1125593f677c15dcec0d8a3
  • SHA512 dae516af06967c92b55bfbf4ebde35c5d2715c7351a24abc000f8674cfe91ca7ba52a42e76c05e9d9d4b652aabb33b6fdf7928b2e3159750de0f34b273057756
  • SSDEEP 12288:BVrlAzQ/kTlVtWS1+RBULetaX8x5yUi43n74hIAQr2TLdo+2R8CgUFVyuAOAOF:uzQ8Tl3GBULqVx5yUp3Vl+2RzbPF
  • TLSH
    T181D40106B7A754ECE2B7C875C8160662FBB77D1203506B3F13A086726F23661FD19B29
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hackedcredential_accessdiscoveryexecutionnjratpersistenceprivilege_escalationspywarestealertrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2