Extracted

• • Target

    2d12f385866e1909e347e8e72fd865a5.exe

  • Size

    37KB

  • MD5

    2d12f385866e1909e347e8e72fd865a5

  • SHA1

    7a4cd5557784673f6928b1d1483c049f8be8fb84

  • SHA256

    a0a129f04cc9d5c95f0d5acf38bad7e6445b7927df02cb7c97b657acfa52f30e

  • SHA512

    a86d492423783546476e8c9375c24e606fb1bc2f35ef1ecfd0dee7c44fad6052315ee96c8a621d50527fa26c4969cfaa2484a2928dbae7e2912ca50083af9aad

  • SSDEEP

    384:beELEUiFsbK7FmpE8QyEfQEP/gfPMIArAF+rMRTyN/0L+EcoinblneHQM3epzXPD:6EH2n8LEfQEg3MZrM+rMRa8Nu9Bt

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2