Extracted

• • Target

    a4cf7bd0cc9fefcb6265492a1c4e139e210e874028dfb6f27693a882f88293ee

  • Size

    57KB

  • MD5

    c5d18393ac40ddb909f213c290e38733

  • SHA1

    b6958e2ce585357eb50ab2a03e32f724a368331f

  • SHA256

    a4cf7bd0cc9fefcb6265492a1c4e139e210e874028dfb6f27693a882f88293ee

  • SHA512

    7d6eb7acde2f20571c4cbea754958deeabdbca6e31ccdfe67677cc7e72c78f6b16bc61088877b9afca21331a60eb611fcd97faa3a23c4c6cfabf391e76ba3e55

  • SSDEEP

    768:Mb9glF51LRpcnuh4/rB6H3vv64DnMAOXYGlsPsHJ:49glpLRWuh4/kXv/MBXRWkH

  Score

  10^/10

  njratcitadelevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2