Extracted

• • Target
    mshalb7.exe
  • Size 55KB
  • SHA256 251b4fa2cbbd85f153ab498fb13323fd896e69df7556890201f274b8c9bbeb6f
  • MD5 306981ba9eaab84f875032c30c06ed27
  • SHA1 e788c724e643136d9cfeb32231b80bdc097d3a2c
  • SHA512 f6aa17eacb1da074ba3f2987174f902086bb601e080c47c71cfa8e4676ba2a81714743ef5aa23f01e4e3e043424a5ec5d2e366fad6c9a1913426ddf7aecc17b1
  • SSDEEP 1536:KkYADnG5N3HSdfd7ED9wsNMD+XExI3pm+m:gADn0ydtED9wsNMD+XExI3pm
  • TLSH
    T153431844BFEA4A01E2BD8F3469F655150634BA23F532EB1E88D568EB17327C58C40FE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationtrojanransomware

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2