Extracted

• • Target
    4423.exe
  • Size 55KB
  • SHA256 5b192a11bec82d09ed75dd2ccc328648a10a1b5ff1ce0d82624ab1658cf86341
  • MD5 b0da1dd12a3e253774046a35e1d77439
  • SHA1 106d65d48bbd5f50f21d0c3a5b5d27f15c22902a
  • SHA512 40d4e725e29275c04ab371c37f6f292f9cfd07bcc4df89fc2d8d2ed00bffc4333a203e7954badec39b04832824c433dac60c3d2f93c2e6763e3cabf2f8c858f0
  • SSDEEP 768:E0CPl+t1Man0KI2NO5SioJ3Q8kSNFmwFvfu0YMDHPsFL7XJSxI3pmNm:E02sDnXNO5SiKlDkwsNMDsXExI3pmNm
  • TLSH
    T1A4432744BFEA4A05E2BD8F3468F659150A34AA63F532EB1F48D568DB13327C58C40FE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverynjratpersistenceprivilege_escalationtrojancredential_accessspywarestealerupx

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Uses the VBS compiler for execution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2