Extracted

• • Target
    jaffacakes118_HEUR.Trojan.Win32.Generic.8a9f5732753c78a09081e
  • Size 43KB
  • SHA256 9344528af21df243de0b6a2b0090a162f5f82dbe95abcd444c07a97ac8e74643
  • MD5 ab9a33e54138a9f5732753c78a09081e
  • SHA1 fea0c899f913c0d36e73e24e25bcbbe1c8a411d0
  • SHA512 cc8a99e5d27c8c82bc56872a71159e3841c6c1e045d0261571bb52d40f7e4512d2c0e33e375a21c0c022ef616ee0cc9f266cd167b8f4e3326872307a34396cb6
  • SSDEEP 384:eZy79dHvw99nNklijEyLQP0PXcCEG/TUXrhDzkIij+ZsNO3PlpJKkkjh/TzF7pWu:kqC6AjRL80PMA/IXvuXQ/oV/+L
  • TLSH
    T1C813D74DB694E174D5FF8BF1A492B2890B71A01BA802D30F99F154D94BB3EC09A11EE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hackeddefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2