Extracted

• • Target

    e792b472aba1b5339a61e539fd53cddbede5d09dc590aa2d70eb334aed47652a

  • Size

    234KB

  • MD5

    4a5727e19af37605f8cbbb536c1ba210

  • SHA1

    cb247fa9057166e4d6614271c6338e589a391582

  • SHA256

    e792b472aba1b5339a61e539fd53cddbede5d09dc590aa2d70eb334aed47652a

  • SHA512

    e7eda0925c91633a16fe59933fb599a58543186ce7cd8403953527d8efb85e07a6015fdc133096c4b8395b77b4be0374de5d8cf1edad2836d7a5e5e0d1426c43

  • SSDEEP

    1536:HYG6B6W5QIvP4/gKvaciMxZlFiv+iE2rs/BvAQ+ayLG:4AW5QIvP4/gKvtiMniGt2riAQ+ayLG

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2