Extracted

• • Target
    كرت فضي وهمي.exe
  • Size 55KB
  • SHA256 1fdaf96634b9f7ca1fb018979ad8ed60d115cb25bb1ccb692ada52e2c78df3db
  • MD5 d1a0498e20c7e7eb673ddb240c85f357
  • SHA1 de0a72a33a61983f5fb4765eb7505522c9add5d1
  • SHA512 bb978ee9f8ae68b8492d7be2c250ccd166531c7b8bd6cf401ca01574e28f4d2b99594521a9a12f09509e435600e1d2eb24b35319a259106b56a277dea364e047
  • SSDEEP 1536:YEgcDnAvNtki5pKD6iwsNMDZXExI3pmZm:icDnA9vKD6iwsNMDZXExI3pm
  • TLSH
    T194431844BFEA4A05E2BD8F3468F645150634BA63E532EB1E4CD668EB17327C58C40FE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebootkitdefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationransomwarespywaretrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1