Extracted

• • Target

    cc12b69766a3cbe0621fdfc4d297b4841888b9a273a6fc9ae05af9476632350b

  • Size

    23KB

  • MD5

    699d8897247b3fbc787743f23e0915c0

  • SHA1

    6dd7ae8e2953ba033db6a13e5ce083a7063e1c17

  • SHA256

    cc12b69766a3cbe0621fdfc4d297b4841888b9a273a6fc9ae05af9476632350b

  • SHA512

    153bc1d1fe8c36478f48d16a75e583e965670a44c339ef96ef1095e859b53c29f4d77efe61de93b0323e8db4f3137ecc6c7ce46fa62e12358ec32976acbd855a

  • SSDEEP

    384:28aLWS0dABLYVq6RxP8MDFF09vK563gRMmJKUv0mRvR6JZlbw8hqIusZzZVf:5Xcwt3tRpcnuK

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2