Extracted

• • Target

    a1142dd58b658687a9dfc83bfb327dfb.exe

  • Size

    85KB

  • MD5

    a1142dd58b658687a9dfc83bfb327dfb

  • SHA1

    cfc125408dd419fb9a9308e80d3c7091780a417e

  • SHA256

    37fa414b1beac72d5693525b934478c64655b122948b0f5ce9a647b4b08a8554

  • SHA512

    7e8b5caf291c35a29d8e03f8a9ec9950ac91fd9e32519961c0dd1564d8233f9abe76af39029d59ad5c5f71dd95c30e8f9fe201e344bd465a4a93eca7c6a3f18c

  Score

  10^/10

  njratfffevasionpersistencesuricatatrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2