Extracted

• • Target
    ZARAR-PREMIUM.exe
  • Size 55KB
  • SHA256 a36647d198f31eb89c541bf8cbd1749a609af5ec0177fc9b6125fd69e5826b18
  • MD5 34e652e3a5d441e2b9c1d4c51f127859
  • SHA1 484397aad61da8c2c75c72a57f15d81417eb4f9d
  • SHA512 a90f87ddb6f1a16115d8603c6469580a019b44f5dcec5435735bead8983a93e56488d2a9d097c0898cc3b70dba6c47fff75acc0e50d7802b3768ab4d78f06e62
  • SSDEEP 1536:cDgcDnAvNtki5pKDXiwsNMD9XExI3pm9m:5cDnA9vKDXiwsNMD9XExI3pm
  • TLSH
    T157432844BFEA4A05E2BD8F3468F645150634BA63E532EB1E4CD668EB17327C58C40FE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebootkitvictimcollectiondefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationspywaretrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2