Extracted

• • Target

    536823aedad97e09b78e086c114cb6d73ceee22b3ed6d7701133bdc05feeeba4

  • Size

    2.0MB

  • MD5

    190a1776f091fffefc7c60d052664cf3

  • SHA1

    a4b7c5059caa1882fc5d9ddb6c7eb7b44608bdd6

  • SHA256

    536823aedad97e09b78e086c114cb6d73ceee22b3ed6d7701133bdc05feeeba4

  • SHA512

    70283b7e1cb158b9c37f0e54a9fe532f48b42405d4a5ec7ad49d1c71894244765fe3153a23d696ec731f87d72a4d4bac426d1d3f2a1bfbf87cbabbd9452de431

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2