Extracted

• • Target
    Payload.exe
  • Size 55KB
  • SHA256 6c1a15aa4e42400c325a364ea2d1e4c91a47c6995ee81f15154caf664c5660e3
  • MD5 c8bab25ab6b415ae87177d1d6435dff7
  • SHA1 4c202b0be945e9cd4302eb2be53d4a4f985cb42b
  • SHA512 c3e509488b151d9aaa2234d0a1873317214e19bd57d4a54aa4fb9a695e5b8e7b0bc8669c35cc5a63714e461dffc70f11de9446c7e878243b2b8cf1bbdd220168
  • SSDEEP 1536:ME0pMDn5NBgyLiOzDtwsNMDRXExI3pmxm:OMDnRxGOzDtwsNMDRXExI3pm
  • TLSH
    T15A431744BFEA5A05E2BC8F3468F645150634AA63F532EB1F48D668EB53327C58C40FE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationtrojanadwarespyware

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • UAC bypass

    defense_evasiontrojan

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2