Extracted

• • Target

    b6e5d2153b3a9c78b8e0e03e23357a96531d8514919bd64330a90fb6a59a3a14

  • Size

    29KB

  • MD5

    6733a25b5cc4577c5101c2fa583e9f30

  • SHA1

    8806867144e267542cc63d2304cd97e0cb76ae9b

  • SHA256

    b6e5d2153b3a9c78b8e0e03e23357a96531d8514919bd64330a90fb6a59a3a14

  • SHA512

    cca0213f61532f0ae220bdac85a5d852270c12ceacaaa67d255878e2e20d4cb8221165bb89da282e324dc2285f454903150b60a1f3c6acaedc0a85dc1a4f401f

  • SSDEEP

    384:OhQXpl7dzns8oDw/LRP55/4GWmqDSeXegLGBsbh0w4wlAokw9OhgOL1vYRGOZzXB:OE7Js8oDSJz4wqZXenBKh0p29SgRh/

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2