Extracted

• • Target

    b9eda6960bcd76713365e3d9d4f70bbcc6e1076e60e7469302752d081329a29d

  • Size

    591KB

  • MD5

    82e3d008dcea0dd6b2952a8a37ac7440

  • SHA1

    1ec7f57afed0b854f408083b341b6088c51ab1df

  • SHA256

    b9eda6960bcd76713365e3d9d4f70bbcc6e1076e60e7469302752d081329a29d

  • SHA512

    c41d89f5bd9c5c46e14fabd13bd5a51c5bcbcb69eb3c4b70b05a62d3d8ee4b1bb9d3eb18c08fc52a5523545e05b13514f0e3d5374d06005e0c8dd54d3c5f52fa

  • SSDEEP

    3072:gCmByk4u5v5c1smXzT4y6RYbVpV90V3KjmcZgCWkVdqrabbSX8F3:2BykAxXX4y6UnXSKpKCFCrQbSX

  Score

  10^/10

  njrathankevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2