Extracted

• • Target
    00fb790999d31006cb8506e2d067fc3e.exe
  • Size 2.5MB
  • SHA256 50a0f7a4caa6bf6e5763e7d102ca2755ba37e8047d97a3bd9986c8f5b02e78da
  • MD5 00fb790999d31006cb8506e2d067fc3e
  • SHA1 13d3ddb0522ee0d3b378a4d57a047699a0336d5e
  • SHA512 3791115e4e928cf5819bab809ef918134d00607abed3fca69a42152703e30b61ad7bf18014b8514a70ae6186fe8caf2b9a433dbca078383645050f7af6a4a1cd
  • MD5 SHA1 SHA512

  Score

  10^/10

  njratpointblankevasionpersistencesuricatatrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata

  • suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)

    suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)

    suricata

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2