Extracted

• • Target
    DiscordPTB.exe
  • Size 55KB
  • SHA256 4d4ae64ec93ce503e31ad963d15812fcc926dbc655512271cb616ff94a4bb78a
  • MD5 0dea77fe8d0331a6373fa10f81a6e813
  • SHA1 ab08a27e8e867650fd83325339186db2482af9a8
  • SHA512 b072fbd2f7f932a88d20deed9582ec1d49e25455e05599340cfbeb39936360aa14aeb4aff4c07e79d59995752104f8337fed526a7af5c84942b059c4e539bcb0
  • SSDEEP 768:U0CPl+t1Man0KI2NO5SioJ3Q8kSNCmwFvfu0YMDHPsxL7XJSxI3pmqm:U02sDnXNO5SiKlDfwsNMDAXExI3pmqm
  • TLSH
    T11F432744BFEA4A05E2BD8F3468F659150A34AA63F532EB1F48D568DB13327C58C40FE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  dlgededdiscoveryexecutionnjratpersistenceprivilege_escalationransomwaretrojanadwarecollectiondefense_evasionspyware

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Modifies system executable filetype association

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  behavioral1behavioral2