Extracted

• • Target

    53caf7631ce89d012f65671379f89256d7b2e3b4671c54edc5c0e1c5d360783f

  • Size

    63KB

  • MD5

    3592c0c1bb5bca3a4ffa1bcc913b6c4e

  • SHA1

    6bd255b3f1452e70db99d29b9768445128ac404e

  • SHA256

    53caf7631ce89d012f65671379f89256d7b2e3b4671c54edc5c0e1c5d360783f

  • SHA512

    fc61763d0b7a030120dbf0bd00b51c3c5f2a0cdf7c942e70bd35e88c076f8a73ae163a5cb3e1dd97ca34879dae2d0a57315969e68564ced6a065089d97b42db9

  • SSDEEP

    768:k74oqIjlLTAqM3eFBKh0p29SgR7N8R8uvRTEJc5v584yyckhRqf4TXRWaBVj:k74S0psKhG29jR86uZ6Qv58khRqfk3

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2