Extracted

• • Target

    4d4fd60cef5406e72dbdbde6ca6f0f1ccd20d505f6ec59a1a91270969c288c61

  • Size

    23KB

  • MD5

    100ffa7dcf8ff1e0af2ae060e36d2330

  • SHA1

    3f7bb7d2d48e05a686ba2f9b1e9deb42cdc612df

  • SHA256

    4d4fd60cef5406e72dbdbde6ca6f0f1ccd20d505f6ec59a1a91270969c288c61

  • SHA512

    7def31c3e61fa9957a85737696dd8ae898c335c448ba173fadd3b9a2570a935c0ad8fdb629a857bb24a62103fcc883deebc7266e563a70d96cbb58e387f0066e

  • SSDEEP

    384:MsqCm6yocx/Yp7jemiO0nd08/VQ6bgNQC5h7tmRvR6JZlbw8hqIusZzZID:TSoQA6mlcrRpcnul

  Score

  10^/10

  njratalex-hackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2