Extracted

• • Target
    FM.exe
  • Size 55KB
  • SHA256 b1c5f5cb91e4ea3908cb21f466d2abdf0e6d8f73e6a4001ed16fe6e7c42b2cb3
  • MD5 1909c397cf32e0a3f12b54acae9037d8
  • SHA1 e2d9c0f4d3c407266683d20b5cd5b21b0dc0e013
  • SHA512 797145d2ae47c62a4ad8ede6eec6cd7001aab75c2b23e699e15212d0c6cc02c0a002bbfa6fe269e82af010ea5f813e04a69a7ca0cce5b0e7a0bf282aad1a0193
  • SSDEEP 1536:2NpMDnE4uNRty4X96ShDVwsNMD4XExI3pmwm:8MDnlYk4XNhDVwsNMD4XExI3pm
  • TLSH
    T1C6432744BFEA4A01E2BD8F3468F655150634BA63E532EB1F48D668DB17327C58C80FE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryadwaredefense_evasionexecutionnjratpersistenceransomwarespywaretrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral10behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9