Extracted

• • Target

    974eea6647d03213b94ef32da55844787c06b793cb339b964e6b777566cccd2b

  • Size

    56KB

  • MD5

    6ccb7038cef6779c9e8a593777d63c20

  • SHA1

    2932fe91f331511e71fd67c5d0d1b645ce6a7fb0

  • SHA256

    974eea6647d03213b94ef32da55844787c06b793cb339b964e6b777566cccd2b

  • SHA512

    1fb85fbcf726e121e657d4a232fd3d1f5d9488c78bbd4e105088185a1985e3cccc3d4e6f4818609dfa86df3b3c550e840771f50c016d3cabaa18de52fadb3a59

  • SSDEEP

    768:FThqhOYcKpQGJKY/YK52+N3vONJvuuzs/tn+eSMUToEInNkHmc5l:F4hXpK21A+94oJtn+MUT0kHmWl

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2