Extracted

Extracted

• • Target
    file01.ps1
  • Size 551B
  • SHA256 9ce1862cd1e0f03c78e29d6da26fc8b66490f69a6decaf1c40832d60c45fead8
  • MD5 384a8c1d66afeaa6d66c142d288832f7
  • SHA1 459c7f48f3bb33f0e230a1507bf8de760c04c358
  • SHA512 613aaa9eac2ef73a9ff13ede45ad633b04a3d638aa3e1a248234ea1ec6b40c07eeb814e2bec8082085646e32530bfed7b6319bca812938b3027064d777ab7137
  • TLSH
    T15AF02B3EAF78F8F487BE9544C8201E4F30550573CBF05A65E853257A9D9A21ACB3B19C
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  dlgededdefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationransomwaretrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2