Extracted

• • Target

    47e369084dc53537f0e372f06d672ceab8d42754b58c37abb039702e91ab9831

  • Size

    23KB

  • MD5

    cd162dcd5adda92368e606d9780434f2

  • SHA1

    7159ed2eb189e69ff045a61ac546fd3cbe422555

  • SHA256

    47e369084dc53537f0e372f06d672ceab8d42754b58c37abb039702e91ab9831

  • SHA512

    190cf917ede68df9d6b05ca42327d59506b8ad402fedf90e7a95d8a43eeb3bc91d320e3e310be72a22c2b31ce26bd51dc4bff8799560295eb0ff7af614ec8634

  • SSDEEP

    384:8slUlEvOEJ8xWwYJOMiOBZEdj1567gtwi5HhbQmRvR6JZlbw8hqIusZzZ6z:1eEvwIlLMRpcnuT

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2