Extracted

• • Target
    Payload.exe
  • Size 55KB
  • SHA256 6a4d23ee0fad642dbebfe7a5a0bc9e5b81346b8cbf2de5cf06974ed40a062598
  • MD5 c91f5a4aa849b0326259373c18b72c82
  • SHA1 551e2bb1af488e64a2f8b17231acd178b0f946c9
  • SHA512 b48dde59000e96d072fea1df2671bf6c0de417f61cf1f5ca71aa6d9fbb52bec64817174bcaa8c8002437fdbe19724fc7022c25c9dccfb02632dee62a118d13fb
  • SSDEEP 1536:zopMDnE4uNRty4X96ShDVwsNMDKXExI3pmkm:6MDnlYk4XNhDVwsNMDKXExI3pm
  • TLSH
    T1E6432744BFEA4A01E2BD8F3468F655150634BA63E532EB1F48D668DB17327C58C80FE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Disables Task Manager via registry modification

    defense_evasion

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1