Extracted

• • Target

    9053bf7c3206713597481ba4563833c03dece95115661c100bf3f54c9c5d57f0

  • Size

    104KB

  • MD5

    612c66a36515026a56be7247c26fd640

  • SHA1

    6922a1cc14516d538e9e4eceb7e5fd8d1b13b15e

  • SHA256

    9053bf7c3206713597481ba4563833c03dece95115661c100bf3f54c9c5d57f0

  • SHA512

    144ddf3583f3beb070da6af93c7aa568dfc48f312be6e233be45b1f11d0c68aea27671cbfc0da1ce260d43a96b352a34c296490f2addd345aba8ddb1eaddb9f5

  • SSDEEP

    1536:fv35cLcZpzG087Pb5xAr9DoM25s5jKXQqoXihO+NA43FizmPlQ:fugx8zb5OpDoSU2i0+fwOlQ

  Score

  10^/10

  njratنورتني حبيبيevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence
  behavioral1behavioral2