Extracted

• • Target

    4ea398882bb10bfb96d1e9e81f7a6045b77e7ccaa10bdec1005005682f66b6e7

  • Size

    31KB

  • MD5

    3f9137d11dc9f3cc23e0cf9446d3dd7e

  • SHA1

    8378807bb42d3e1c99e208e52748c682fc717912

  • SHA256

    4ea398882bb10bfb96d1e9e81f7a6045b77e7ccaa10bdec1005005682f66b6e7

  • SHA512

    4493444f53b5f87888d7081c61c1d3d0916698769eef07736734b35e0aa3a31d2031d13c0f41f740bb417e48bc5fcae4e7ec51903c064ef1e08a703cb86bc187

  Score

  10^/10

  njratmeevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2