Extracted

• • Target
    wll.exe
  • Size 55KB
  • SHA256 5c5e01909b49edf14ffc648e816c73cfc74099e9154895fe11754f584f46b898
  • MD5 acfc257ffd56220c5d36ce31d8c875a8
  • SHA1 b7fabe5d0649298312c773826ec486615a70b726
  • SHA512 f51ecd92455747b36ee14b691c447a484b66b28ea11521ada74a4a55b4c556566b901ead800d150e732f55765eae5a4d2bd57b9c283d5cdd84e7dadc7396e134
  • SSDEEP 768:cD46lOt1Man8E2N6FikUt34okSN/mwFvfu0YMDHPshL7XJSxI3pmQm:cDLcDnCN6FikSJDOwsNMDEXExI3pmQm
  • TLSH
    T14D432844BFEA5A01E2BD8F3468F655150634BA63F532EB1E48D568DB13327C58C80FE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryexecutionnjratpersistenceprivilege_escalationspywarestealertrojanupx

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2