Extracted

• • Target

    d5df48431d5d69553eb8cbeb765d9526aa3d8e7ac9702f22a7a633ba4051fa7b

  • Size

    28KB

  • MD5

    680b9619b47bf350bf27fcd362566e50

  • SHA1

    a74d839c2b6143d8c921ba3080e54756297e8859

  • SHA256

    d5df48431d5d69553eb8cbeb765d9526aa3d8e7ac9702f22a7a633ba4051fa7b

  • SHA512

    3f25d72f365f492c2493d7f4896832ff35dfd7ac9ca2735a3817933180535b100d77bb9979f7a91471606686b78bc5d4eb3120eac92a8c9c91ffe835f290641d

  • SSDEEP

    384:bK12nLNl73t5otQMOdetp53hBxqGmqDQdLbeAKGBsbh0w4wlAokw9OhgOL1vYRGx:bKG7jo2MzPHX8qQbeIBKh0p29SgRSz

  Score

  10^/10

  njratmohund almadredeevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2