Extracted

• • Target

    a432f3b58304914500790d32ab264eddc60f598e80c0d47b98d2b0d9e65e5fc0

  • Size

    159KB

  • MD5

    0978a10c34e6c0a82c77a1fe2d668cb0

  • SHA1

    ad2c6a960566f156191d12ec04aade94aa214867

  • SHA256

    a432f3b58304914500790d32ab264eddc60f598e80c0d47b98d2b0d9e65e5fc0

  • SHA512

    b5bc40c8754f9495f74df02cfc28fffb10659dcc6420cad67577c9ace69bdee1292bd36013d9f3260bd09bf3f2d5f93fdf8d19be95ba45dfc3b0b982d979f019

  • SSDEEP

    1536:go2SP6QhKUoQO6XcbAUnvrAp/er6t8Bmh6l3SGLEvlCzC4iVAvrCPSuraAB40aao:zTCQh1oYUs0+tWM6lJmYCizZoWWH2/

  Score

  10^/10

  njratmortathaevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2