Extracted

• • Target

    1e4cda70b68ba9332bb5304954a54179c9123d42b20cf85a5be7148b14decd04

  • Size

    31KB

  • MD5

    d2b6c3f19a678b8829ab876aefa2e6b2

  • SHA1

    b6213d238f9c6210c4999d766dcb19f436102f9c

  • SHA256

    1e4cda70b68ba9332bb5304954a54179c9123d42b20cf85a5be7148b14decd04

  • SHA512

    02cd029adb888a9d63c79abbad0cad22c18369b360b34564ff99643085fe81bf2646e3e2004ec0048bb88563ffd7bee1f7023c6437c8780f868a68cd6aa74373

  Score

  10^/10

  njratbormekevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2