Extracted

Extracted

• • Target
    script.ps1
  • Size 188B
  • SHA256 b258d87458f2c36d1d07ab4fc17a49b34966ff05a0226b8156614796c0c945bf
  • MD5 45edb364869aceb5f7f2539e3c6d20de
  • SHA1 330f4780c2bc953660027616f48b00d53d31339b
  • SHA512 a3ff0362f6546ebbd34a945ef48bbf2a2437d2ce1e529d213d39d06b3ec43b5e222727c0fe383f1dc1460fae2b3c4f0a6b363a2e8c10c187e752a2a7970174bb
  • TLSH
    T119C02221E088016E9D2A2083B960770A82C18008A8C41DA1C5EA4C0121002C223EA080
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  dlgededdefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2