Extracted

• • Target

    ef5ab7f0f4e7e83b532e082fe5c3458617f020b6b2ad6c83ffdb6f8ac2b1b37c

  • Size

    23KB

  • MD5

    6c1ca8fb6f463aa56f5f530480732880

  • SHA1

    817e4ed0453ecccafb94e89725e263b1d23c2c07

  • SHA256

    ef5ab7f0f4e7e83b532e082fe5c3458617f020b6b2ad6c83ffdb6f8ac2b1b37c

  • SHA512

    048b7b4b58c87814d2c713c43550d6db214e417b24c7757db53828b52ee90235c423dee451d9a4a4a3ca673a92e119b89b5661bd025211e231a58018be234384

  • SSDEEP

    384:8oWtkEwn65rgjAsGipk55D16xgXakhbZD0mRvR6JZlbw8hqIusZzZW5:r7O89p2rRpcnuR

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2