Extracted

• • Target
    Payload.exe
  • Size 55KB
  • SHA256 ee8276cee83e2aa69aab51e6b0ae02da734b9d9ecd42d66af463e5ba9b8f3a3c
  • MD5 76f391bd2be703da503c511854bd47f3
  • SHA1 e103dd9517b4e8e47adb23e42e6fd597dad4ac87
  • SHA512 e12ec631ab1add197d9baa4c0b953725d3fed554df16238bce2163bcdab4792baf08efa852e8099461df1af7483e337a9109b69c40d91d56d6d5ac1ccbf44251
  • SSDEEP 768:p0CPl+t1Man0KI2NO5SioJ3Q8kSNFmwFvfu0YMDHPseL7XJSxI3pmgm:p02sDnXNO5SiKlDkwsNMDNXExI3pmgm
  • TLSH
    T1D1432744BFEA4A05E2BD8F3468F659150A34AA63F532EB1F48D568DB13327C58C40FE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationransomwaretrojanupx

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2