Extracted

• • Target
    Payload.exe
  • Size 54KB
  • SHA256 1f88515f11e4d6168282e27e97643894a18953f6b2791aaecb82ca7ca3d86275
  • MD5 ac344d490fc8eca1d3726a70c27ccf55
  • SHA1 c89a45ab69046b1f19cfd4356f03b02813b89d23
  • SHA512 a1f092c49218937b7429b53627c2ca70c91e3ae9b13a3ef82a9b52075821d86332e43e9673d6b892170ed6391f465a19eb9d8bf1d310b05971f6e26d17ff4827
  • SSDEEP 1536:yroADn8fLNG/SbrKDD3wsNMDHXExI3pmem:XADncsqbeDD3wsNMDHXExI3pm
  • TLSH
    T1EC433941BFEA5A01E2BD8F3468F655150630BA63E932DB1E4CD6A8EB13327C58C40FD6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionnjratpersistenceprivilege_escalationransomwaretrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2