Extracted

• • Target
    22222222222222241413547.exe
  • Size 55KB
  • SHA256 4bf29b9bd00ac8f55eeb30ca052567f5f33dd4252aa6e86df84a37065ec213c9
  • MD5 252c5f4a0dd599a2f9ef0d3c3e5c030c
  • SHA1 96dd435688ea1cbbef4ef4eb14acff0fc103629e
  • SHA512 d0dd1358b8f5b4ed4a9f023f1b2115106e28d2f6da33c5bbe9256dece3153a60ede078200d688d2991d4ce0bdcdaa9ecd42ead924fb0bbed2435dc94cf0ab8ac
  • SSDEEP 1536:XFTdIDnrNZtLy9CIDKwsNMDmXExI3pm0Pm:VpIDnRekIDKwsNMDmXExI3pm
  • TLSH
    T148431844BFEA4A01E2BD8F3468F655150A34AA63F532EB1F48D668DB17327C58C40FE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence
  behavioral1behavioral2