Extracted

• • Target
    Payload.exe
  • Size 55KB
  • SHA256 295b2cfdc547f8748153f1208d23b5437c4888c619ea51a9c86b3f5eec02759b
  • MD5 1d7ee99142e346d323a68d066dd690b0
  • SHA1 08cb11480ed9c9029af4054f13698fda2ee1b155
  • SHA512 b5d3010833cdb68e3897c2f4e84c1a83ba593dc261a0613082b0b905ed30cc5acf274706af2f42e0bf4b68f06cdfbf870ccb8c12a66bc806e866d5a494267d7f
  • SSDEEP 1536:gnpMDnE4uNRty4XXzdhDmwsNMDFqXExI3pmam:IMDnlYk4XxhDmwsNMDFqXExI3pm
  • TLSH
    T1A3432744BFEA4A05E2BD8F3468F655150634BA63E532EB1F48D668DB17327C58C80FE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebootkitvictimcollectiondefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationspywaretrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • UAC bypass

    defense_evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1