Extracted

• • Target

    69a1f9fb95247f6decf04d817a6c0715c86aa09f7fadf6902b6292f0d49918d0

  • Size

    905KB

  • MD5

    9298a561a8fb25ecd82623decf63e030

  • SHA1

    0e55af8d345123d46bd7df3ce18f55fa5e100447

  • SHA256

    69a1f9fb95247f6decf04d817a6c0715c86aa09f7fadf6902b6292f0d49918d0

  • SHA512

    2b073f29bad7d1dda19d87b26f118e8aa1a19892e0152efe0b697374122f08bec2feb56474fc1a5afff9bf2cec7c9338243865f70560b5f11fb3f8e0292e693d

  • SSDEEP

    12288:9BhsH/rtR2Rr6ioMPZtsonyAHnFJCSEwf+zPRzkvFrrSH+VfGCdRvME9AjHehhy/:+jtRynGMc82xouP

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2