Extracted

• • Target

    22f2f32bf6b04f72c7dba0b95a68eb693479990812295154bce9556f2afe8f61

  • Size

    157KB

  • MD5

    63b59746d741123403af33a51be88740

  • SHA1

    bd338c9f266a7d6566ca44f5075af7da4efc7a97

  • SHA256

    22f2f32bf6b04f72c7dba0b95a68eb693479990812295154bce9556f2afe8f61

  • SHA512

    0e12681d62430d2f75ddf84e0078be6e5c0a16f3ab556780eed707f84c6d7c20e8b17b142f60113818fb0109e4ea93fb3ab1052eff37975ce90ed9f19af3fbb5

  • SSDEEP

    3072:0+MGCirgKXQGanA4ay8j95Vj8JfKySY08kVkvYYPbVv:/MGCirDXQRnA4a7p84rkkVkvYI

  Score

  10^/10

  njrathackedtrojanevasionpersistence

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2