Extracted

• • Target

    c3009a51b416c6a22a6c044cbf0b7a9a9b863a7632da9a4e01efc08aec2bd37e

  • Size

    546KB

  • MD5

    d297e0db6d63a952b08b6f0e3fe101e7

  • SHA1

    52da80a4605dd658284a4a510861ed875bfb3dd4

  • SHA256

    c3009a51b416c6a22a6c044cbf0b7a9a9b863a7632da9a4e01efc08aec2bd37e

  • SHA512

    66224735ce06bb86a5d28e4c7d2afe0f06865a0e669ddfdbbac5bcf34e27c5955bede4562517b67cd63320b625b37928c6e5b8267c6dafd7bd37ce583fffc451

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • Registers COM server for autorun

    persistence

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2