Extracted

• • Target

    889fae79a25bbb5e43f2276b571e50a54409eda6ad4a481dfeabd3a727a61a29

  • Size

    23KB

  • MD5

    2dca2c8fb8d62970d06d7c9f53c758e6

  • SHA1

    30a99b983bba0e0a526fe559079ecbb5e24d1bd1

  • SHA256

    889fae79a25bbb5e43f2276b571e50a54409eda6ad4a481dfeabd3a727a61a29

  • SHA512

    9e80731749c84c4e734292db48b1e434aae39e2f1fbce2aa9ff476894e7d72376243f64604b3312f16bcbb8e4c252e04620fffe661eec678ad3cd0970d193495

  • SSDEEP

    384:psqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5DVmRvR6JZlbw8hqIusZzZguBf:if65K2Yf1jKRpcnu3G

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2