Extracted

• • Target

    1f67b271e2ab95fd8889b0f95752e17d4b489ea8bd51fff3e23d9e48e8b54c17

  • Size

    3.2MB

  • MD5

    37185cf06ca09e939d74fa52692cd2bb

  • SHA1

    28d3d5093cb8e9a4cb41e27c345a755d171c4c91

  • SHA256

    1f67b271e2ab95fd8889b0f95752e17d4b489ea8bd51fff3e23d9e48e8b54c17

  • SHA512

    4a68a39f7c8c978f9762a0f6347002572e438503b202696c499eedcb60db6bf5bdc260ec6471db4a608a51c97349aa18dd6cadf84487e21e9f10c2043e54f1a2

  Score

  10^/10

  njrathackerevasionpersistencesuricatatrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2