Extracted

• • Target
    Server.exe
  • Size 93KB
  • SHA256 70485ce33c53aa8d552707b55c43cdd6a02a3d63d84756063e2a5846b4aa4869
  • MD5 f15de45c13db7eab4decff2866eaeb6c
  • SHA1 01a4cf9a4d1fbea3bd9ca5c60f712c06806d0956
  • SHA512 29199ebd88319c9fd78627eba6572f3610da1a1d16ba49a058dfe01f350b0c34a636b767433bd27cc7f494d05df0f79d7cb90d09f4472eb79807a37be4252d9e
  • SSDEEP 768:gY3lVfhWXxyFcxovUKUJuROprXtWN8eYhYbmXxrjEtCdnl2pi1Rz4Rk3VsGdpYgM:9V5WhIUKcuOJhPhBjEwzGi1dDlDYgS
  • TLSH
    T19293E74977E56524E0BF56F79871F2004F74B48B1612E39D48F219AA0A33AC44F89FEB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hacked by vrmydefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationransomwaretrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Disables Task Manager via registry modification

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2