Extracted

• • Target

    Igra_dohle.bin

  • Size

    103KB

  • MD5

    50fa1ee2eecc6acb1d766bc8e1208066

  • SHA1

    bc5e5a3c45fd0c25bb8687c13bb3738b2add7a11

  • SHA256

    8bd02aea71a800580dbbfe4c5de8efe8d409a8d7a00010355c722a17f3a6f8e2

  • SHA512

    95e3b767f3d5e65907461b6d503735aa791a5764325472b6e8c0ab13f627b7a8198d9adb2767484264e6b3989276229a8695517e1df0dbfe89a9ce25400d922f

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2