Extracted

• • Target
    FPS-144-PREMIUM.exe
  • Size 27KB
  • SHA256 2e167d78aac4bc221758fca6c00e3b6e41ac6243e5d7a63b8859fcfb364b0c1b
  • MD5 787f28a1c394a8f35a8eff0ee3fb2bb5
  • SHA1 be9373a6d09193be8b90bb0dd4c123361600ee7a
  • SHA512 f9791fc0945da784771a9d84f8fbe292fab85a210a02548e58f98487c76d396f9edcedf7ae0a1f741bfd98a917710c73ede5dfe282060f50316ebc652d47a45d
  • SSDEEP 384:RLh6uj/+AU9038hfOexuaP39hRnMZAQk93vmhm7UMKmIEecKdbXTzm9bVhca26S1:Rg0mkspJtyZA/vMHTi9bD
  • TLSH
    T1ADC2F82D37B68272D1EE067E4562DA5043B5E04BF267FB0E4CD958ED4B1B38A0A41FE1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebootkithackedcollectiondefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationspywaretrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1