Extracted

• • Target

    ab66c6e473af8c24d185b542dbcd204af0daf9d220ff97861deabb86ac636478

  • Size

    338KB

  • MD5

    66cb58b83a174b565129d99b2236af80

  • SHA1

    77943715633b6b028da8e6e90e9bdfdd4f0a2c59

  • SHA256

    ab66c6e473af8c24d185b542dbcd204af0daf9d220ff97861deabb86ac636478

  • SHA512

    2df04457ca3fd9e94a1487ec765615dd884888f38ab654d369bebf64d27bed6bcc6321f50e647758e9f95c71980edbcbc66cfddf9a4d6c376ee63819668983e9

  • SSDEEP

    3072:uGnurkvWoy0+w6jpGyFWWH27TkJionKuS6:uGpWpPW/EC

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2