Extracted

• • Target

    926ec604fc6598362b361d3c56db967fb1566cf8c82723921d482a540679e642

  • Size

    33KB

  • MD5

    538a95adc47384e2b9cc837488628de8

  • SHA1

    d0ead0592e2f891d1304be71ccd755c78e94adfa

  • SHA256

    926ec604fc6598362b361d3c56db967fb1566cf8c82723921d482a540679e642

  • SHA512

    947e0b370b1599d2957441ba203ffcae7dff19c7a12e76613bf9ee839fd46a311689c349ee7a721fc2e8170a55ee64a1c062f13f891d8279abe83d881f3ce627

  • SSDEEP

    384:CDKimCftl7ndJoc8e9v55Do7mmmqDspHe4qGBsbh0w4wlAokw9OhgOL1vYRGOZz9:oKAD7zoc86xi74q8HeoBKh0p29SgRoo

  Score

  10^/10

  njratboy hacker kurdishevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2