Extracted

• • Target

    Q4EtLThkYlEkFvu.exe

  • Size

    474KB

  • MD5

    18156edcb0549e6e856811b5a57b951d

  • SHA1

    c9c773a0157562c8fa800aad23c670486fd63fbd

  • SHA256

    8c6ca1c8128480b39bed5d584b13880534bc0155cf05df5ab5ebd1dc63f53207

  • SHA512

    c881d069a6403a22b02ee71dd062fdb6718f23c6c1de859d142dcd9e4c642555c3c5f72bc6b0aa1bab3ff6539a7c59e3415bca0b8f636cfcc5b9dbd5afb39775

  Score

  10^/10

  njratorder1persistencesuricatatrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata

  • Executes dropped EXE

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2