Extracted

• • Target

    bCP8.exe

  • Size

    23KB

  • MD5

    6e449b0b98b38524647b74f93d180cd5

  • SHA1

    04a51144421253ec992a1d407b3d006849f58e50

  • SHA256

    36ec0ed30e8a776d4e7635b565859b28db6262c1772ca082ad1c2c211523547f

  • SHA512

    90fcda2f004b021045d88b1cca860f50fb744c68e380cc9fce183a2c26410130454222b55e71867e27e9721bdc9877607e24e4f3e1b1eaa32d2a4dff168d9915

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2