Extracted

• • Target
    h (2).zip
  • Size 124KB
  • SHA256 0caa03056898fa4cae587dfd48e7a8d8c1384aad702b2e738f91efeb8dd3de63
  • MD5 23872d01f6014f17479964974a3cbccf
  • SHA1 af8b3a99edb952d6761a581e80e3cf77c4b6daf4
  • SHA512 bb442545a6b047ad05da060f958681541db7e28ae4dca635d674a10b7cb439e81475cb506540ce8c047cdf8ab8ab9ea0e9fe36e6be8976d560cd2e9b3139a57c
  • SSDEEP 3072:xDzMu0qg1sttDO6DbmSUGKZMghucWO34KOnB6kkR+JraR:T81EtyDSUJuCucJ3LwgP8JraR
  • TLSH
    T139C31219D7F1688BD7893D3233BDC59FBB3B889F358CAB493A459816720A913B1207D1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1
• • Target
    h/Western Union Receipt_pdf.vbe
  • Size 36KB
  • SHA256 7c9d67ad610f3e2dca0f499904db4d9c952494ac3e4a7afc120a4ce2a10fd03f
  • MD5 fc77a122f5eb77e6adf467a127b0d268
  • SHA1 521dabf51a1d817b3f209f3f19cc7abcd3cc93ae
  • SHA512 5100609c885aa795cac966d1c47ba6eff6909a3f3c366833837f925dd7e26e2a16117356efb8bd5030add65434fbd8f6be368623e5f87d7c65701e5de8d57113
  • SSDEEP 768:TLD/WFowdvrJrk6zHJl9WGkwNCaLw+o+f+4fT0ztOeC:TP/WFowvtrlHb9WGDdVo8tfQz4eC
  • TLSH
    T12803CF065306FBB928F9962DE3056BA4C3105A31B864F345A179E7498E32F8B75CDCB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryexecutionpersistenceprivilege_escalation

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral2
• • Target
    h/h_backup.vbs
  • Size 60KB
  • SHA256 91a016ede74b17f49cda8b22f068d86ee2baba5953c225a1ba2afe444042e504
  • MD5 7924e91ac223b461e00dd27e83d28745
  • SHA1 0640fd62cee46992c38f719841de6869793d6088
  • SHA512 bf72b48a7bc0bb17fd2c8211ed86de119eef60dca69112521f0d8f62557e0f6be39fc132f5e9036906d119e1c57996a773b4252659c80c1a23aa0c8543e40095
  • SSDEEP 1536:P3TrTrTrTrTACND2KmJ8kinTmWu/F/bybylyqyby1rT7:P3vvvvcCF6tWaFTqaPqOf
  • TLSH
    T16D535CD6FC812FC34F382A1668EF6A9D097C23F12BF17964F98D2B46C091896B550D5C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryexecutionpersistenceprivilege_escalation

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral3
• • Target
    h/h_file.vbs
  • Size 71KB
  • SHA256 1e283923d0ace370f2086fbfffc3289eaaf5aa37e6e09f8ab3c1bcd1e554372c
  • MD5 b483675f3be18a0a4880554ca71e04a9
  • SHA1 f8060c593c7e34ce6f457f84ce7e998adb41fe3d
  • SHA512 20076491bc79e058a88bd991b3cd1edc6cb5cec37820ed2f48ac5503960a28ed9188fe4b9e1c8861c855d90866a3e3a254f4660e8b67e6fe08465e0334534ed3
  • SSDEEP 768:ebOJHtm2CXjtyt3tm2vSfqsbyR0rdAoLS/4sQIUfqsW/yUimWhfqsa0fqs4tm2le:sIHtkjtyt3tGQ0rc4sQdmWWtrI/
  • TLSH
    T156737D05DC142E488214550AFCFD7DDB7E2C578A65F37A8F3A3EA1823249766B1C98BC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  5^/10

  execution

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral4
• • Target
    h/h_hussy.vbs
  • Size 66KB
  • SHA256 7959cc182931f13ca9b88574fdcaf5a94cee4ff70fc01ab4ba8187c0ce186db9
  • MD5 e45c73be71d8aac4ebd23bb5ade52e93
  • SHA1 5e6cbef7852cc83ee8d04abb92d935f7fe851b02
  • SHA512 5ad198675d0129e3fdadcc9462facdebd7b184e3d43d7604a680ef77ab8b7369dd65b0a80480e1f901193d582d27cd1ac7207cee1585f17ada5ba2297d2e8106
  • SSDEEP 1536:q8FzskYTlTbOTT1oZQr791xTfLhZM3KtMAwhbFvrwbZszsOtCCrOsymHJR:qkzskYTlTbG5kQr791xTfLhmKwhbFvkg
  • TLSH
    T180632123BCCB1846770923E75B03F8508D339E563FC45CCA689751A9B2697271D8ABCE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hackeddefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral5
• • Target
    h/h_nj.vbs
  • Size 87KB
  • SHA256 d38bee8968b7cea5b4733fed8aa4d37469dda960ee1d4030e7d2d923c1f4012c
  • MD5 7a10ae8191ae9d3ec6e30ec2282361a2
  • SHA1 22bb98a8d69b47bc5f565abd3c8998807d96f6ed
  • SHA512 96582b51dfe952ccaa0edf00635185e52d79bdc3099918aeb7940f78a66ba9a5c6e9c7a66cf66eb4b25170230f77b05b7e3e2f7c3f13d0515df5113576789aba
  • SSDEEP 1536:sIHtkjtyt3tJhP25aCvAl8WZoxTilg0tNMBcbeQaXYLWJoMstrI/:sIeahP25t4O6Jlg0tNMBcbeQaoLsAI/
  • TLSH
    T1E693B643BCCA280A7B0D7323DB07F4948D375ED63F561C66685B01EA21A47171AC9EBE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hackeddefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral6
• • Target
    h/h_njrat.vbs
  • Size 73KB
  • SHA256 06819342e4b060386dd7ad3066b85ee12f55b0a1b09c91e29ce73530c4aee941
  • MD5 b25e603a74256ee631708908707d07e1
  • SHA1 0ef44a7c682f7a479e0d650a1c0f1186938460d5
  • SHA512 202cec32d8849a27aa32dbdc7a284d59527dfc4714dbbb875e3655e1d74662f6eac9f2ec0465cd87fb1e599ec6e69c54150f33b09ade24a5894c86b0b253061a
  • SSDEEP 1536:anh8CVJNm5fAHeUFY9fC/4KgQvX6IYCveG9ofnAnNeRyp/3vOacB325QXQrEM:aqCVJ0uY9K/rgQvX6IYCveyh3macB3QD
  • TLSH
    T15673DD2326EA32858D08FD77BB9538A3DC2078F15FE1AE8581DF5334B7240656F981B6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hackeddefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral7