Extracted

• • Target

    7f806c97ab68106ea238c1e5bc906388

  • Size

    8KB

  • MD5

    7f806c97ab68106ea238c1e5bc906388

  • SHA1

    571e34bda90b0194f6c7bc353e5c0c56a7143d38

  • SHA256

    b757bd1c8c93b75204ca653d5b602e98f1b3a174a1657f185dd4794fda4a2866

  • SHA512

    e1b998d4b1f3786d711bf647615787082fd907ca1c50c9731cb2eea843da85b33cc04ec1bf60b22693ced7acc392dd5c09f496b1cfcab3e2ed50c85a290d13c9

  Score

  10^/10

  njratfuriosevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2