Extracted

• • Target
    Server.exe
  • Size 23KB
  • SHA256 0e11b52f037bdc1d8952157c101ebb3602e2b00aa415f7936f3a6eba84761786
  • MD5 ffc1fde18dafdecb64646246376b3af3
  • SHA1 220e1e12a9f43c40c541ec1d37625b99ded25de1
  • SHA512 5584c60ee559e3870b199f3036fb32a9a68f510e6524bc89debb9d383def7b9f9f03c501ac4c9e4d6032efd8654e49ed94810bf564619a07df164a4eb99da588
  • SSDEEP 384:bQeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZQY/:c5yBVd7RpcnuC
  • TLSH
    T1DAB2094E3FA98856C5AC1774C6B5965003B491870413EE2FCCC954CBAFB3BD92D48AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationspywarestealertrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2