Extracted

• • Target

    db731100da3baefd7a76fa016a39771f9cff0725b93ab88b3e327ac951db400a

  • Size

    310KB

  • MD5

    0ed30a1c45c46ca45ece04edcf230df0

  • SHA1

    799eb202c00af96842dcb7b284bdceb7017ff9ba

  • SHA256

    db731100da3baefd7a76fa016a39771f9cff0725b93ab88b3e327ac951db400a

  • SHA512

    f76d59873d06787a7787cdb2c9485b6fef3eddd51a9d4492984efede89dc137a061a294de71b5d775849b02e48e736f4de6bb30bcea994fd63ae2196fbf324c0

  • SSDEEP

    6144:I8eRNCeY+SEdScmc7VPuHcSf+Vb+Iu5FrH3J1Gu747Ym629e:0RN1Y+oOhAqZYvrH5y7Ymv9e

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2