Extracted

• • Target

    a32d3d621eb984c0b1e1118d68affb540f93437ebe72aa617ef299b139ceb95a

  • Size

    110KB

  • MD5

    063c9b17cb6924d0f6397d6fb964a746

  • SHA1

    4b6731a10673ad11fdfd6e7c0e0fd43ed6741120

  • SHA256

    a32d3d621eb984c0b1e1118d68affb540f93437ebe72aa617ef299b139ceb95a

  • SHA512

    5222c6d70bb28870189ad3748c150cca56817d09cfcbaae2e96bd78e3b59f035e18dc0138574e6b8ad48fe35ef8877abdc1f9b0eb52753323e68301c3732a3bc

  • SSDEEP

    3072:ipYuA29RHtoahfwte+7M25WkS08i1PdPa4pa:g9RGahSMTL8z0

  Score

  10^/10

  njratoday's friendevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2