Extracted

• • Target
    king store.exe
  • Size 153KB
  • SHA256 cc1ee49f2ca7dc3614c1c0cba3103cd0bd870e5da4cb0595d1e37918723bcd97
  • MD5 0c755e9a3f36a7cd0f85737a5996ee89
  • SHA1 f76ddbed800f9009f506628c01fe5d0ca45bdd69
  • SHA512 09fd55b5c04703c268d9ecf0baa8a7dcbab8b93148c7532e7675ca10dd4514bcfc22d3eb6a570e803feb9c0b256427e7a7341875748dc9cff6da9883621d4346
  • SSDEEP 3072:kEbS/KKFI7ob2zLBaHvIz1G45xozy1HGc7xLSYGi:kf/KKB2H4e1TMSGi
  • TLSH
    T1C3E34D17A6A671FAD277C934C9520905FB327C764B60ABDF07504EB60E23AD09E3DB12
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionvictimdiscoverynjratpersistencetrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Looks for VMWare Tools registry key

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2