Extracted

• • Target

    e8c5ae21497796bbb296b0e01ab743739f15153a0059bb4709cf7eba2a3a31bc

  • Size

    23KB

  • MD5

    45c2097b3e02593577bc6bd4705aa590

  • SHA1

    79cbaa62c0c129471435a8af5eefc7831c3a235b

  • SHA256

    e8c5ae21497796bbb296b0e01ab743739f15153a0059bb4709cf7eba2a3a31bc

  • SHA512

    a1cda5b41db6e8b7af7ec59942b25c00c42d57407ca35f83130f19ebea1b57e9ae8002966fdee171e37876cb1cd845c1f40268f7caddb0e430670efc09f44332

  • SSDEEP

    384:KMKyOkBkRbohza8yuTUtZu06cgV4a5pzomRvR6JZlbw8hqIusZzZkt:l/YI1TDRpcnuv

  Score

  10^/10

  njratrbgrbgevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2