Extracted

• • Target
    injection.exe
  • Size 246KB
  • SHA256 c71de033cef2324ccca35b4a8a30a0745ed724cf44318f2f3a6c471b650d3383
  • MD5 92bbf69805d56e0069f0501646a1fc6c
  • SHA1 20cd203ee18043034eb12ffd79d26523628cdc05
  • SHA512 9c8899ddb48d837ca8921f64981f0e2de89a8425013424ed5bd6d06c867e31c55445cd876f4a7ca60d801692bcd438e9a2202ed32ba258120ec4b6d2dc770ed0
  • SSDEEP 3072:9bXwTaganGCxdERV8Q2AU8EHBAnpK37nXg8i0B3Q75274tyJhIMKWnFpQ7is3K4y:dXwTagaGCH2qPe8Pw8xfQ+s3K4/s4
  • TLSH
    T1F7347B4117E8C93BEA7E17B9E4B1161027F4E14BA912E78B788C16E95F633404D633AF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  victimdefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2