Extracted

• • Target

    6e652fbc4551ca4f71ee62ea06c4091d6ca20db62c8ac54837461bdddca60ee0

  • Size

    89KB

  • MD5

    6239221711b96ccb760da6c546f1fab0

  • SHA1

    98b4bd309e1b7fe664b5061bb82c25882eb17aa2

  • SHA256

    6e652fbc4551ca4f71ee62ea06c4091d6ca20db62c8ac54837461bdddca60ee0

  • SHA512

    d02ac1223946c4a8b6d1a8974088e5acaa73ba51bb6e5b52a8844cbd819dc3ecea070c959f9c26d400d8c5eea6b1858c1abd0e81a7039d3dc88ee600f72fe0fb

  • SSDEEP

    384:d8aSyS9gB3Y1KIay2X8cLZI6XgxsGJVPpmRvR6JZlbw8hqIusZzZ9ZaByEA:e589tXvRpcnugwyEA

  Score

  10^/10

  njrat?????evasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2