Extracted

• • Target
    4444.exe
  • Size 55KB
  • SHA256 47e073cd84f4b6615835f87e9b8985ac8c91dbca19328ddf74164ebe41809126
  • MD5 125e3de4a73e5d8900fe8f64f9865606
  • SHA1 593a5dded06ee11692819b85dac8cdffe0cf9a9f
  • SHA512 b9fa1f3217e4e176c872feb2b3da506acfdf019aee878b1399fb9b188e3205189e4575707da9710b138c43c46bd288c02d8688805cc7ef7cb45874118d47f10a
  • SSDEEP 768:nfCPl+t1Man0KI2NO5SioJ3Q8kSNFmwFvfu0YMDHPsFL7XJSxI3pm7m:nf2sDnXNO5SiKlDkwsNMDsXExI3pm7m
  • TLSH
    T1F9432744BFEA4A05E2BD8F3468F659150A34AA63F532EB1F48D568DB13327C58C40FE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdiscoveryexecutionnjratpersistenceprivilege_escalationtrojanadwaredefense_evasionransomwarespyware

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2