Extracted

• • Target
    Server.exe
  • Size 23KB
  • SHA256 0d74168e6590b0499ab22d6273b295730390701e73992b2e3b5388f5a86df201
  • MD5 9e69205e2c3f451dcdc9a7fb133d0538
  • SHA1 0ae81d58081f4f63bf90d7085db05c5f40574768
  • SHA512 f378cd8b0f95569ed5be1af686e9eedf2c2229cc969f5b93ebab68c22f103e13ceb805746045743c34ad521db0007ac9e1fbe8b48e5c06d4b23ccd9f7359d107
  • SSDEEP 384:P+n2650N3qZbATcjRGC5Eo9D46BgnqUhay1ZmRvR6JZlbw8hqIusZzZdlK:om+71d5XRpcnuR
  • TLSH
    T16AB22A4E3FA98856C4BC177486A6965043B0A1470413EF2FCCC564DBAFB3AD92D4CAF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoverynjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables Task Manager via registry modification

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2