Extracted

• • Target
    Payload.exe
  • Size 54KB
  • SHA256 27694e6645515ce3506c3f341f8c35e93fde361af22da3fe15102e91e89d8217
  • MD5 b275d7bbda9a55a26ff4689134d60a10
  • SHA1 9fac866b2e5a75a121cae9fe3c135ef657cd91a4
  • SHA512 6a870b9fcaeb531436957708ab47f8c7734a2fd2566f5f5a34fef55cd6d6088c18f99a13ee6351676d051c0cd033ebf09f0fe0c7083f65a9f1c8ac4a7713ed7f
  • SSDEEP 1536:yroADn8fLNG/SbrKDD3wsNMDHXExI3pmWm:XADncsqbeDD3wsNMDHXExI3pm
  • TLSH
    T117433945BFEA5A01E2BD8F3468F655150630BA63E932DB1E4CD6A8EB13327C58C40FD6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2