Extracted

• • Target

    85395f149f761f4e48f587914ba92228a560c6d58aba7992ed85bbf6f912191e

  • Size

    23KB

  • MD5

    6e1530fb60361275acac36bc5022fdd0

  • SHA1

    98f5a23e846dd22f2952ec1126506fe77b465501

  • SHA256

    85395f149f761f4e48f587914ba92228a560c6d58aba7992ed85bbf6f912191e

  • SHA512

    d5b1172946c11350c57a96d51f029371ce151a6643747eb7916dcbc9f2d21553cd530b6db6beb9c61e8a30ba68db6b04c00a5be4daca7f739883d1d707c3dc2c

  • SSDEEP

    384:xNpMKFYuEEhERvoBG16Xuy0MHNw6Tg1Y+75JTFmRvR6JZlbw8hqIusZzZwX:xNCW4V6+yDRpcnuF

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2