Extracted

• • Target

    5207c90533759690decf146053496e4a652cac1e232e777d20988c9b378bb692

  • Size

    23KB

  • MD5

    0e634348ed64f9f053d9271926975f99

  • SHA1

    162c7587da2f4f04ec68dfada490c23df9efff64

  • SHA256

    5207c90533759690decf146053496e4a652cac1e232e777d20988c9b378bb692

  • SHA512

    50ab9bd7e16f5997dca00210bc4043a6587c34d73539a8ccb7d5ad9eb06f727557e32190904c7be16c4cb1a34feff176a169ea549895dd9da8e8c50c03e03a7e

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2