Extracted

• • Target

    3ece68411637a9f876d1576d7486cb553efccf1891959ab7b005ef68b296978e

  • Size

    1.1MB

  • MD5

    6db1a6346a3b25ecbffa2935fb14ec80

  • SHA1

    62f8dc23aa747f01b4b88737de9bbdce907e3bdf

  • SHA256

    3ece68411637a9f876d1576d7486cb553efccf1891959ab7b005ef68b296978e

  • SHA512

    f030168a13c97ae14d24c89bd4076baf242a310d1618302bc391da0f594f0c6ff1e53458c857f3a1ee540809d91a8c4ffba31dffe1eab70a7b8f891b4bf727c6

  • SSDEEP

    12288:w4vSyN7kiUo/t1kI83H6HphukQteSrN7kiUo/t1k:w+97eI83EUeC7e

  Score

  10^/10

  njratvictimevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2