Extracted

• • Target

    8e89bfc3381d4c122767c66799c5502e62b998cd229a4f03eccbc1d845960308

  • Size

    23KB

  • MD5

    6a49d3f2f3d0d192dede1fedcdb86870

  • SHA1

    ded1f9fa0bcdd670e3277f51596d612672355e29

  • SHA256

    8e89bfc3381d4c122767c66799c5502e62b998cd229a4f03eccbc1d845960308

  • SHA512

    80e80e2da91f201df3f48ec656b5f332ce194749f57c20f5f79e5785dc4c1c76494290e9b2c119b79ca53031851d6e588476a1e5d1808f58f9b3835e14358ceb

  • SSDEEP

    384:BQeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZl/:W5yBVd7Rpcnui

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2