Extracted

• • Target
    Payload.exe
  • Size 55KB
  • SHA256 43928467506f198adaab4e629f5afbe537a3a5b7adc30fc8189b455b9248e23d
  • MD5 ad15631a2f4d08a72a82cf16dd3808a1
  • SHA1 e3fc4b162a71d593d69f62474e9aff964d05329b
  • SHA512 d70c3d186169be54ee1fcebbc24e21a2c4f2e5d85260c0de3a4ecc1ea26677bd265bd4a4a319fdccd7898ce51594b6ff95af7c7f784f764203b7626705449c65
  • SSDEEP 768:dxOecKt1ManMy2Nrjyjyn3UhkSNjmwFvfu0YMDHPs5L7XJSxI3pmem:dx84DnANrjyjmADKwsNMDUXExI3pmem
  • TLSH
    T19E432844BFEA4A05E2BD8F3468F655150634BA63E532EB1F48D668EB13327C58C40FE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnjrattrojanadwarepersistenceransomwarespyware

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2