Extracted

• • Target
    mshalb7.exe
  • Size 55KB
  • SHA256 251b4fa2cbbd85f153ab498fb13323fd896e69df7556890201f274b8c9bbeb6f
  • MD5 306981ba9eaab84f875032c30c06ed27
  • SHA1 e788c724e643136d9cfeb32231b80bdc097d3a2c
  • SHA512 f6aa17eacb1da074ba3f2987174f902086bb601e080c47c71cfa8e4676ba2a81714743ef5aa23f01e4e3e043424a5ec5d2e366fad6c9a1913426ddf7aecc17b1
  • SSDEEP 1536:KkYADnG5N3HSdfd7ED9wsNMD+XExI3pm+m:gADn0ydtED9wsNMD+XExI3pm
  • TLSH
    T153431844BFEA4A01E2BD8F3469F655150634BA23F532EB1E88D568EB17327C58C40FE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationransomwaretrojanadwarespyware

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2