Extracted

• • Target
    Payload.exe
  • Size 55KB
  • SHA256 822bc184466634a80f68c410015b24489a87bf0fa73d11dc966fec96254348a1
  • MD5 71854b223ef6e918e3307bdc226d67f8
  • SHA1 4aa3204982f24459e9ea7498187e840da2fa6cbb
  • SHA512 accb5eeb92507179dc04c82649d12b3bc0a1d56470883cdd39576aba067da321afcea8c88bbe37066ea93d974cf54b816946fa9e84f1666e10cd285bd3ab832e
  • SSDEEP 1536:y+UMsDnKNgpynpGSDLwsNMDOMXExI3pmJm:HsDn1on4SDLwsNMD/XExI3pm
  • TLSH
    T104431844BFEA4A05E2BD8F3468F645150634BA63E532EB1F48D668EB13327C58C40FE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnjratpersistencetrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  behavioral1behavioral2