Extracted

• • Target

    79d28707a6d4f60cfe33fb7370f689d13d7c18f95daeac1b9cf4ccf94404f9fc

  • Size

    201KB

  • MD5

    6d15ff6dddfc27c4727009bc8b027e40

  • SHA1

    5f62ccf80990d04beed3591a37b129827ba8a4f3

  • SHA256

    79d28707a6d4f60cfe33fb7370f689d13d7c18f95daeac1b9cf4ccf94404f9fc

  • SHA512

    2df58a38cc8edd47539d88b10f8f344afdd1bdd52940069d94482220b415d96929ce0793a3fd4fe1c516de0788be7b9862edb973959c382df61eb72a5f7d1c92

  • SSDEEP

    3072:2Pivtv//s4yl817h+Ne9wnFg8tZinkbu3f6c78HGcGuuxeDfDz:2qvt/EKSr5tUkqP5AHGUE

  Score

  10^/10

  njratsounddriver.exeevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2