Extracted

• • Target

    Quotation List_0348.exe

  • Size

    6KB

  • MD5

    53e70bf3a2964e9c086d8ea3ac0daddf

  • SHA1

    82c8534e7cf0cf7d899d5871d0da82ba9c875f3b

  • SHA256

    246e869353e3d90c8aef21611cdfa29f32eaf84c07382ceaa0b251818213c541

  • SHA512

    74c3f2d7f4ad771690dba6ee0e6964aeb77aaed77bfc5d4e3ad3dc0104076a2085383272697247ec3191cafae87af437333f024323160f0af6714bf0663ead6b

  • SSDEEP

    96:XVuqNek+1LnGPL5RT2SzLAEy/tnp347KVYzNt:wH1Lqh2SzLAEUNR4g6

  Score

  10^/10

  njratupdatepersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2