Extracted

• • Target

    a258fbc6346a5c5fcc28480a601d284c.exe

  • Size

    27KB

  • MD5

    a258fbc6346a5c5fcc28480a601d284c

  • SHA1

    d579a1a2d1e79885ad80d4b3eb4d1a294f205399

  • SHA256

    c9e8a120268308c6f2392fdb2fa65dee5f2cd48b8bb3433d5de9842ea1d987da

  • SHA512

    7733d6836ceba7467d4925449297c69732e2ec5da9a6c93089deb2cecf2053726c6a91588a5255a71fbfd76bd8af89c74dab1a4ee19ee09ed6f88c3ff333582a

  • SSDEEP

    384:2LuFFWP0CDZwnXmIQXkj90jEwmFterkSuldsP3NBa6Ml7AQk93vmhm7UMKmIEec1:wnRICol7A/vMHTi9bD

  Score

  10^/10

  njrathackedpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2