Extracted

• • Target
    essencial.rar
  • Size 12KB
  • SHA256 b1dd6ed64b1d05e4b0080d73160e3839567e2e72e1c29b7f1b6bebef57147e2f
  • MD5 f13b61c362b061c42fc4490066cb27fa
  • SHA1 8aa7e0762fd26e1b669f83afd633e94fdd2254ee
  • SHA512 f87fdb22e968497b10b0391e1dcc65a711b3b794adf3842cbb89ee5d1968b713e24a2a0cb5a04387fc33a27570b02c19257135d03fd74558fe5ead77bd774950
  • SSDEEP 192:v9bLmlhwUT24xjPRLhVmbGYOftIKZtNfpHzo3Kk6t+Ro+jpMPoh6T5mmAUNj4hGi:pOwbkhVWOfSKTkpMQh6T5mONKb
  • TLSH
    T1EE52C08BC299A90CC12AE9C8FE56BA563AF0D436538B319336EE514911C404EF6C0B9D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarehackeddefense_evasiondiscoverynjratpersistenceprivilege_escalationransomwarespywaretrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1
• • Target
    essencial.exe
  • Size 29KB
  • SHA256 f95da37a6225bab1e53e57be54810d0f6094e96bf4a8e8bc7c6debf9ff70723a
  • MD5 da371734a03505924ee2607f5e4fd155
  • SHA1 aeb8e98bdd806e3e3dafcd382f9110dcc65618ae
  • SHA512 35c41f4920f833a7353f65b95c01b2679b1243499381ac53c58f773fc577e519fc441ac1f802388a92a56b39b5f035063567369cef3841a329a70cc27de59795
  • SSDEEP 768:87JEWe4VQ3hmBRbqwHeWBKh0p29SgRdr:87J8RmBRbRHKhG29jdr
  • TLSH
    T1B4D2091937B84906C4BC1B74C53196274AF486032952DFAFDED1A8DA9EB32E41A4CFE1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarehackeddefense_evasiondiscoverynjratpersistenceprivilege_escalationransomwarespywaretrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral2