Extracted

• • Target

    486a93bc98a58d3e88d4c491c15b1ab8f331efdf8206fa0e5d4f52754abf01e3

  • Size

    320KB

  • MD5

    67c17d16cda6cdabd9b3e4d5bd0f9a30

  • SHA1

    fe9d1dc96b44fae3cd06b4db3447f61bcc93262b

  • SHA256

    486a93bc98a58d3e88d4c491c15b1ab8f331efdf8206fa0e5d4f52754abf01e3

  • SHA512

    30525df3a7c45e93f77acebdfddc73bf01726725dd7f719f046c3502a002fc376e7c3c2d5db2774b151bdaa2b99549e0dbf96242d26e1ee7973678b9a3f26107

  • SSDEEP

    6144:PMOhqDDjBG3q28TKH3kdULeaSqVig4D033ziJztkIMao:PMO+PBA85tkIMa

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2