Extracted

• • Target

    5114eefd8d1720dde3195d2ce145ee6d14bf74eae6cb1902d3049dd2b591ee5a

  • Size

    31KB

  • MD5

    20d1dd5fffbe00e92ecd03ef84d4c453

  • SHA1

    78191645fbe8381a65efec83e1d96e14ef9bd8cc

  • SHA256

    5114eefd8d1720dde3195d2ce145ee6d14bf74eae6cb1902d3049dd2b591ee5a

  • SHA512

    1ae4ea038d26b63984e17a692f552410820c9d3fe8b1b51b89619e49269833dbe3e517299a044206c6e38692140ff933ea5eca34cf28a07c7bb0674d7084c9a7

  Score

  10^/10

  njratqevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2