Extracted

• • Target
    Payload.exe
  • Size 416KB
  • SHA256 dca6be93143301568340c1061fa6f45f7f5e6ede3224e869f5fad4bd0c63eb31
  • MD5 9508fb0016831f47b7b28d3ef4042969
  • SHA1 5e4156ee2f61a58510ee53abd0018fda492c5d8d
  • SHA512 f4df8ee54ee77f09bb4b69eadd9037155875b63da2b48b20118fd0c039f98860252299eddad0ba82b22bd3c85dedd1a995df35ff2da85e8e31ac086b68fafc17
  • SSDEEP 12288:OMVXcpreVXpkU06JAJO6LAF0OoAONc1nv1fQ9u:NNcpreVXpkU06JAJO6LAF0OoAONc1nvj
  • TLSH
    T1B5944290F7549D8BC13A8F7B1BA0F37826B41F726512CE5B04EA5E9F3725A891C80ED4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverynjratpersistenceprivilege_escalationtrojanvictimcredential_accessspywarestealerupx

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2