Extracted

• • Target
    FiveM Hack.exe
  • Size 11.8MB
  • SHA256 234a85a7e731c6ec52cc76c701c957c091ad2c617ded1120df0cf4d1e7843e3c
  • MD5 42818f04a77058512374e21e2b8cf98b
  • SHA1 8ebe30d4b74065144657b3fb41da1a4bade589fe
  • SHA512 e3985934fb56b0e58fddc68b7746c55d6d95749a836d961af24165e3a187a99bf5459e65ab9669d03097ebc4951eac285beb0c82f7f2b02880eb739170a516a0
  • SSDEEP 196608:rcnCmwXXFByGrF/jlEfUEowKaL3XS9RyH7aL2gqbgyE1loxBJ+78+n:rcnCXFR5/YN0aL3XS6Gabgyc8BJ+78e
  • TLSH
    T191C63314EBB102FCE0B3A674CE879941DB75B84A53B0DB8F1751A9A31F271D4AA3DB01
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hackedcollectioncredential_accessdefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationspywarestealertrojanupx

  • Deletes Windows Defender Definitions

    Uses mpcmdrun utility to delete all AV definitions.

    defense_evasion

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2