Extracted

• • Target

    0a2b4ca9090f8ae9f69d99466376f108.exe

  • Size

    37KB

  • MD5

    0a2b4ca9090f8ae9f69d99466376f108

  • SHA1

    36e66aec5aa6b23c4139352aedcda41fa59272e5

  • SHA256

    ae88b4f33250bff23d4f922e0a2939140641e9842584bbca1ebfa8b0ba62d7af

  • SHA512

    5b1e2c09348142e3c5cd41c6e64b28767104ccc5d9f1086b669e2306598dbb3cc149987ad04e6cc318aa53478274ff14d938eef97bfc99f3bc1770711b13af16

  • SSDEEP

    384:pAy3hUidkgXR21cGMy8PCVARPj4FltsItArAF+rMRTyN/0L+EcoinblneHQM3epV:6y3fLGv8PCVARUdsI6rM+rMRa8Nuswt

  Score

  10^/10

  njratmixa loxevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2