Extracted

• • Target

    615e57d0292c00ef79137e08ee41c274166c38cf95777365cc8e155d337ec793

  • Size

    23KB

  • MD5

    09d397b770282e1a816995aa81b070f0

  • SHA1

    2ff7cbd840fde7d15f9283de6574ba52540ad77e

  • SHA256

    615e57d0292c00ef79137e08ee41c274166c38cf95777365cc8e155d337ec793

  • SHA512

    3f47f663391ebabbd26092586d506b614364009ccdeb8754c8173dc4e35a2f2e748578a133b49689cb77fbda8679f15a011d6c986e93299db92089e490784cb7

  • SSDEEP

    384:+sqCm6yocx/Yp7jemiO0nd08/VQ6bgNQC5h7tmRvR6JZlbw8hqIusZzZ/n8:5SoQA6mlcrRpcnuo8

  Score

  10^/10

  njratبااش evasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2