Extracted

• • Target
    Payload.exe
  • Size 55KB
  • SHA256 2c7efa07d73218d646efdce467e340cdac9814ddcdcc9653455f593fee0456fa
  • MD5 4b36364d1277668e56cef87a1e66f683
  • SHA1 4df01453a08effaeaa98b230721413ad5bbf60f6
  • SHA512 3b520f4402fecd8a5aad361a2465092fcae78a8671e61e2a3bf226b94dd8f0958b46981fe1bcbffdc6b7942bfcb5f5c8d5fa2fdb471c66a5330c3571051f12a1
  • SSDEEP 1536:HIFcDnCNKFi2dJDNwsNMDJSXExI3pmtm:ScDnLMwJDNwsNMDJSXExI3pm
  • TLSH
    T129432844BFEA5A01E2BD8F3468F555150634BA23F532EB1E48D668DB13327C68C80FE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdiscord_nukedefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Disables Task Manager via registry modification

    defense_evasion

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1