Extracted

• • Target

    ce6a2d6796ed0ba09d6be91a8921ea76d1de361cd7e3051df6712d7403406eb6

  • Size

    29KB

  • MD5

    6aa97dce34e21266f0c9e0ba6a95ff20

  • SHA1

    13d5a19f2b79991106c53bab053d90f571a40fc7

  • SHA256

    ce6a2d6796ed0ba09d6be91a8921ea76d1de361cd7e3051df6712d7403406eb6

  • SHA512

    89751d5545f516ca278e7ba1df7dbb0d576676d3cf4bcab046b23558b838ad8c0e5d46f62963ba25ff869adc9beb2b27ed1dfba650a43a41a53ccc934b2e79fd

  • SSDEEP

    768:k2u75oa4fu124AaPjXeJBKh0p29SgRoG:I75CP2j8KhG29joG

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2