Extracted

• • Target

    39db1b79de11173ee66c9b5eac3ee0afaea44c2c064264c33eb9e9eaf9998fa1

  • Size

    89KB

  • MD5

    163da38a8b9e7bf63b1be4c7fa6e0b0e

  • SHA1

    1987c84460813b1c51cb335d9e0d61fbf33c6df6

  • SHA256

    39db1b79de11173ee66c9b5eac3ee0afaea44c2c064264c33eb9e9eaf9998fa1

  • SHA512

    de73fedceb2d43fbecb343f13837631904de9356db90c8a2eb5400f3e27f95c7c7a375966a8e20a4b7a05bba55a69a1f9bca2eb31fe0bdbdb3dc3c33eaa3dad9

  • SSDEEP

    1536:QN0X/AARWustQ08UreN3B8J1pCDWTtln/gakphoAJae93A1RS4cM:i0X903AJae93A1

  Score

  10^/10

  njratskype for hackevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2