Extracted

• • Target
    3C386A66E5F1D1B341A1466ABDFD137FC23B39956009A.exe
  • Size 5.0MB
  • SHA256 3c386a66e5f1d1b341a1466abdfd137fc23b39956009a5eb149386634b0515d1
  • MD5 e3909de6ca1d545d7c45dff1d9a09fe4
  • SHA1 1624adb1b664a82b1e2605227e017d339d6f52e9
  • SHA512 af1b420ba7688823b0b9624751862f5d822b1a7da41b4c39d2db066aefc0d74796f172f817738d70b0b5332dc27ea13e8677a44f9fd563ff088081f0ceaac04f
  • SSDEEP 49152:WaFPC7nRODEYCFEvlmOmTgtFM3uK5m3imrHuiff+puWV355FXw/+zuWV355FXw/C:FYR8EYzEFTgtFM3ukm3imPntpRrR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  njratcalyevasionpersistencetrojanupx

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Modifies security service

    evasion

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2