Extracted

• • Target
    Virus Saline.exe
  • Size 55KB
  • SHA256 c201d96dc374ecc9b130d3e057044e50fd958c523ac24c00f46fbb1e19baa9ae
  • MD5 15326a95e2ad939e9ac71403b9ccda0e
  • SHA1 d56977b2cc32b109404ab94a1bfe36e30acb8c20
  • SHA512 68630246959fa017229519ce56a521e030c35a8f278e218f37ba47e49c6db5f398ea2fe0338f5560d08fb33b48f76ebfd881bf055f43e075b56695a3a5d64228
  • SSDEEP 768:t0CPl+t1Man0KI2NO5SioJ3Q8kSNCmwFvfu0YMDHPsFL7XJSxI3pm9m:t02sDnXNO5SiKlDfwsNMD0XExI3pm9m
  • TLSH
    T1E3432744BFEA4A05E2BD8F3468F659150A34AA63F532EB1F48D568DB13327C58C40FE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebootkitcollectiondiscoveryexecutionnjratpersistenceprivilege_escalationspywaretrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2