Extracted

• • Target
    Payload.exe
  • Size 55KB
  • SHA256 1504b9413847b67e8ac3b5091b17aeb177263679df765781c7947ffe023e3d32
  • MD5 cce60396ca2add28453e784cc712bac7
  • SHA1 92f9933d2cbede43a08e68442470beae26dc6249
  • SHA512 5d0a4c3627ca5560241496c3cbcdcfe344463a50cd54e8e384aeb08632646d1d25157d128294a22359ff274da2269ad4cca1421f0094669a3174d7713fc1a03e
  • SSDEEP 768:cq+RRCat1ManMLF2N+bcs3S3kgkSN/mwFvfu0YMDHPs8L7XJSxI3pmLm:cF6oDnZN+bcsCJDOwsNMDvXExI3pmLm
  • TLSH
    T157432844BFEA4A05E2BC8F7468F645150634BA63F632EB1E48D568EB17327C58C40FE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoverynjratpersistenceprivilege_escalationspywarestealertrojanupx

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2