Extracted

• • Target

    3f330d95bd8bf7c71809189a1aa5285fea9d63fc7d193cda4b827e04bfa16bb3

  • Size

    188KB

  • MD5

    3b293d74827ff906a5ca3a4e4439e98f

  • SHA1

    76d14a79e2be1543ab79873e7b87f0deee8aad17

  • SHA256

    3f330d95bd8bf7c71809189a1aa5285fea9d63fc7d193cda4b827e04bfa16bb3

  • SHA512

    255295a70314398b0b96d4408f0606d385773accd0d5811cb697ff4f80b58c15f600ef9f18e17b09edfab9879541e6104fc759343cd36e1ed609899598a62d8a

  Score

  10^/10

  njrat|erica|evasionpersistencesuricatatrojan

  • Registers COM server for autorun

    persistence

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2