Extracted

• • Target

    e8b5c4f51bcd44d478a94b80ab6a9a5a45eef78193189169b67010f43f320984

  • Size

    29KB

  • MD5

    72602448b0926ef7fc368b4859e913e0

  • SHA1

    6452052283943b1a2044309712ee79ebde66ca91

  • SHA256

    e8b5c4f51bcd44d478a94b80ab6a9a5a45eef78193189169b67010f43f320984

  • SHA512

    bbb1d854df67ad981c71f093e6b6ecdd76feea92309230f05d32b9097239fcd91fee7af1ac9da0fd2d6216a92dea0f495ee8ccd3e3d93ad699871e5fdf5e0f19

  • SSDEEP

    384:VFUHEBl7p3hUw2s7bD55gEKemqDSqre/IDGBsbh0w4wlAokw9OhgOL1vYRGOZzn9:V57bUw2C3kEcqNreHBKh0p29SgRx/

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2