Extracted

• • Target

    1690eb66ddd1e4ba483f30a6edeb31d5d946547d28b60351db456a7b472fd659.exe

  • Size

    29KB

  • MD5

    f57f1d8f893d352be2ae9e66b11ae570

  • SHA1

    a8f35447d15672bac3dfc6e60197f973c9943495

  • SHA256

    1690eb66ddd1e4ba483f30a6edeb31d5d946547d28b60351db456a7b472fd659

  • SHA512

    4f9b486604f689f985221f8b0351b24867d2a532f3684e5fcec018162709b6f296d5293ce8a689f983bc7d708723591f6eba161d7ddaa514438c98f169a95054

  • SSDEEP

    384:Ec6CqbFYh3odrVCGiHssDB4b6i6fgpEupNXRmRvR6JZlbw8hqIusZzZUejJKUh:TIU0tw3Rpcnu8VKU

  Score

  10^/10

  njratdriver bematchevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2