Extracted

• • Target

    029fe4625db1f972f1f9b55deed08acd14f5377a2bc45a4733770a8ceffd7730

  • Size

    29KB

  • MD5

    646b995f05c88ad1162aa2045cf89b70

  • SHA1

    9266726b62e1b78bb24c4a32fd932223e381f34c

  • SHA256

    029fe4625db1f972f1f9b55deed08acd14f5377a2bc45a4733770a8ceffd7730

  • SHA512

    960d8f078e2ff5b7b23ebe964b7ecc7c8b6e6875a4d7ec5b8f80565365726133ee7bf4905c7974e450790fe0475e4d11cf374c7c66598e99c9b0bdbff71e6c0d

  • SSDEEP

    768:iQv/27NYsDkfZPoIqlHepBKh0p29SgR+K:3m7N143wEKhG29j+K

  Score

  10^/10

  njrathackedtrojanevasionpersistence

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2