Extracted

• • Target

    c19e6a377a5b8926f96c6f06363ce714b12317633137c728bffe9a816d9620c0

  • Size

    29KB

  • MD5

    642dfb848c81bc8041cf6d752f8cc900

  • SHA1

    1f778a332d590a9faf89fba51b483a93846a0af0

  • SHA256

    c19e6a377a5b8926f96c6f06363ce714b12317633137c728bffe9a816d9620c0

  • SHA512

    eb91aa69484dc77302f078f587e4858332bc7b4871a6d314c4b98eef2b468c9f3429ef7e502702aa0ef2f4e077a15fe0d284c7ef2c493bfe74f9d8acf54b409c

  • SSDEEP

    384:SFpQjtl7jBnoKoK3JX15nHK4GumqDAEReIlGBsbh0w4wlAokw9OhgOL1vYRGOZzX:Si7hoKoGJFNK4Aq1RehBKh0p29SgRd9

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2