Extracted

• • Target
    BD2.Net Injector/BD2.Net Injector.exe
  • Size 878KB
  • SHA256 735805f8d687b584e3bddd1992444ac7c400c23fdad9c67e775dbdb81533e975
  • MD5 481bdd5285e7fc1a68bc776b8f0e0213
  • SHA1 597b1cf57db4222f8a2713b4eb2229218bd3203b
  • SHA512 f74a01d5018e5e565df0fbcbae7507ef8402bfe2e592e892b25b10d05ce170369b6d02b4113dc2f9ac212da24bcc369f412fc920634e5897be77b460659e2cf5
  • SSDEEP 12288:IciZ4qN4ZkKdcLtmUzG8GIJ9EhqGOmueCiKWe4ymgGLDONHc:H25kkKdcLt08/9sqGmsKd4ymZqNc
  • TLSH
    T108157D19F6A7C4B8D3A29574896245F2F7B67C8D07609A8F0390FA652E331D08D3B732
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hackeddefense_evasiondiscoverynjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2
• • Target
    BD2.Net Injector/DevComponents.DotNetBar2.dll
  • Size 4.3MB
  • SHA256 3e0a315bc5496aa8e701c83c0b277d30fe78b0b567418baa268912df51c09b22
  • MD5 d499c22917c1a95a1d80b9ff48673596
  • SHA1 638ad22483e5aec468dede04fdc1defe1f7494bf
  • SHA512 7c5272619c546efcd1ded6b3c8b7caae8be9c18683d862aa956847c49a703cc1d6ac878a65f20083f1fafcb8ce5fd7bf4cb90aa115ce58d4c33d3b7aa916cfb4
  • SSDEEP 49152:jfbOYjjGPzyrpoU9L2+46BLhFt+eCdmvMAeQt6xfYUanWPsrtm/l:GYjjJoWLXB+Xda
  • TLSH
    T18F267C4173B4DA3BE0AF8374C12A219943F6D61AE3E3FB665AA1B07D3D43B405907297
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    BD2.Net Injector/Siticone.Desktop.UI.exe
  • Size 1.2MB
  • SHA256 0960f69e0be92ad3528b6421a2ca6796b2cc95c96aba03191bbfe79ecbe176a6
  • MD5 cdb3bd5378677291adaeafa6dc143c8e
  • SHA1 1daa369a25bdf27ebdab5fde9fbbd38348edea1b
  • SHA512 a07d134655a00c740654fa4306533205dd4101c01bea1f70f2be1e9549887652cca345e04df07e97eb7e74ac8e149b23e56af045e379d8d0b80aa0566d553500
  • SSDEEP 6144:SowtqoqMEOOmGGfjGRioCRDjRlA1RkxAmDS:FhyEOukhhjrskx1+
  • TLSH
    T110554392F08BFCD6C70255B55C79A5F03199BF9E112C8E442972FA0A64B36C37427E2E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    BD2.Net Injector/System.Data.SqlClient.exe
  • Size 385KB
  • SHA256 1aec454a84d29e8467f2c07f8027982995a534541303d5e1a472b88b022cae00
  • MD5 cec76334458dce856eb2819a48996955
  • SHA1 3eca1461542b1e21c65ddbca4084df91da92219e
  • SHA512 4233aa5703377586bc91d7df6a51f636bd28082612d3853705c175be09271bf8e70dd64137551fdc4cfb8d76ac9addfbc22a57e87a8d4e5a8fa881e59af2faca
  • SSDEEP 1536:lm7OM2XJRWukAm/Afu8zwis2POk17OH/JENJmD6kK9kJGfBzUhBSSBzo0feoBjNw:Q7OMuJ0im/GEdU
  • TLSH
    T1FC844695E18D3CD6D417A4F5AC39EA10650EFB8E022C8E183977B91A95B32C33076E1F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hackeddefense_evasiondiscoverynjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral7behavioral8