Extracted

• • Target

    b69851b891452d0f3480538d1845afd0e6882414fe7fe429c6bfd028e1ca2408

  • Size

    714KB

  • MD5

    631389d4701eddc61f6ae00662862840

  • SHA1

    e58f715f156dd6d370d00ede130916dac4970eb1

  • SHA256

    b69851b891452d0f3480538d1845afd0e6882414fe7fe429c6bfd028e1ca2408

  • SHA512

    ff71a4b7f29767ff8d32fc028495cb0c926201c784bae4cfa1b73b37eecfe6527377910fb41ca4968c61ed97c6023c806704ea9a401441c48eeb4647229e926b

  • SSDEEP

    3072:VZaoTmaIsQ1azxNhCXf/l8cKTVwNU/eQSKqwpb289TkF/YyOQKcEcF8U41DLZ:qaIdMCX6c2a4lL

  Score

  10^/10

  njratzaptoevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2