Extracted

• • Target

    707c81984e055b8ef5bf439bec0449be52ea160180baf60df314abab53133937

  • Size

    128KB

  • MD5

    6b4961bd714e87ac58bc94057c4729a0

  • SHA1

    0f90067112fe4d6de159bb4170fafc4abf111907

  • SHA256

    707c81984e055b8ef5bf439bec0449be52ea160180baf60df314abab53133937

  • SHA512

    45887544f16f59dc6063ed96a7f3e04335120d08b0f7e6f20412e4fa6cbb6bd90b1a230af07508e6195bb381c1c2b92624a14a33b4d9bc4b075fe9cecebb9679

  • SSDEEP

    3072:JIJO91gvrt/YObLz6tTs6b/KItLvYFdJIwFAd/LWxidvIuV:H1OtgWLGtfb/1lviIkAdEid5

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence
  behavioral1behavioral2