Extracted

• • Target
    Serv1er.rar
  • Size 12KB
  • SHA256 ea395fb13f62d4ae0f926e44646cf6eed0ecffd7822580883730badb803210e3
  • MD5 5f1c7519e1d212bd0a471bde9115d402
  • SHA1 8bf03b0ca2919072ee89572ef203a5a2f3238284
  • SHA512 2176b5aeea2be2cc1f14abd2f9d4d2aae5ce1ba0a7a67d6f74ff77203828c0d40a2a6f2ee6969cb2d9a9fb59628ba9c9bee0a6027423462cb2ad84c8305fb5c8
  • SSDEEP 192:k6hckM3h/aBntbXgIxQpYPIOiJIg7sdygen2Ew7Vd11+PGcvinveJhXs+0rPZBp8:VO35oxxMYAp+DfFAuxasRPZk
  • TLSH
    T1B052C04E43A8C1B9F4E09F0581B82572DE1A5794837CD682EDB6205B5168364FBD33AF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hackeddefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    defense_evasion

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1
• • Target
    Serv1er.exe
  • Size 29KB
  • SHA256 c4d7c6a5ae0ad56a3a30908aba4887a8bc7814d5522fa71a96583a60a8596312
  • MD5 809c780ac944ac501bd9e855080101fb
  • SHA1 3fcd90b12727de521f37b9c9e9032765dccba8d4
  • SHA512 a5bcb9cf4f923b2e8644b02ab48fa369c3895b2502a2f8072f26bfbcc4ec55306023789f2e2a26f9eae08a40a6c35880f0704e233db3933b66c76aa485a7724c
  • SSDEEP 384:AGYftl7H9zoJoc+MFt55H3gQXKmmqDg57eHqGBsbh0w4wlAokw9OhgOL1vYRGOZ2:QD71oGc1Ff1BX8qw7eVBKh0p29SgRZc
  • TLSH
    T1D4D2091937B84906C8BC1B74C431965746F486036912DFBFDDD1A8DA9FA32E82A4CBF1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarehackeddefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationransomwarespywaretrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral2