Extracted

• • Target

    710aee2409e33eafe2d56bdf4c4b8434.exe

  • Size

    37KB

  • MD5

    710aee2409e33eafe2d56bdf4c4b8434

  • SHA1

    551588ca3457971121b63c390c4d52cab13c886a

  • SHA256

    40078261f88c8a91fd32bcbb89517c14efd1b13c217f44c18184be2813ea74a7

  • SHA512

    934b9db17957a539bd8c0356cb89197a6b2b193a9c1b65c42eba8ac3b14b85a02e2298924a8ee4e72e408a12df8359ee02f4547c07d4c4947ac381f5ff40a3b9

  • SSDEEP

    384:weELEUiFsbK7FmpE8QyEfQEP/1fPMIArAF+rMRTyN/0L+EcoinblneHQM3epzX6H:NEH2n8LEfQE13MZrM+rMRa8NuYdt

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2