Extracted

• • Target

    65775c3bb48b84b7d3cc49fe4dbda739721ee6a9bb401a5352c8ddaa30cbed4d

  • Size

    31KB

  • MD5

    6955b2a45017c2222c4597114db081ff

  • SHA1

    372f7cda076acfe22f1b0dd7f83ae1c267a0f811

  • SHA256

    65775c3bb48b84b7d3cc49fe4dbda739721ee6a9bb401a5352c8ddaa30cbed4d

  • SHA512

    f00413f7545ab947acbb87bbcbaedc712e4923ee5bcb256730fddaad222680e4e5e19179cb9a841e3c8bad9677be00c10ac667967a833f719e36c03f07bd3441

  Score

  10^/10

  njratqevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2