Extracted

• • Target
    Payload.exe
  • Size 54KB
  • SHA256 245288dc289d12275c4ee6648553191eee51bc485fb4abcc7411cbe919429c2f
  • MD5 d797169f77a13bb353526563435a0efd
  • SHA1 647097d8c35785cbe6878827cfaf1e8369f9f574
  • SHA512 fa4e282b53c9c883ed79d8bb0ab4a4df82f8b27876a4f3457bd7dd0ad17fd2c26f84bf7fba09a9e278b15a162b41b93024030c87e3db1af5257c680e2986d53b
  • SSDEEP 1536:sJQ8Dn/NEwJGodiDZwsNMD0XExI3pmJm:z8DnOqG+iDZwsNMD0XExI3pm
  • TLSH
    T18C431844BFEA4A05E2BD8F3468F645150A34BA63E532EB1F48D568DB17327C58C80FE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  lzzdefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2