Extracted

• • Target

    6c0651d4ffb403415cb0b97746dfc4c766cfa56c7596f6f402faa71c08342150

  • Size

    29KB

  • MD5

    2d903f5272977fe4b1b56e00eb30e512

  • SHA1

    7c6c050bccc3766e277ccf76d18c61dd6d77d5ea

  • SHA256

    6c0651d4ffb403415cb0b97746dfc4c766cfa56c7596f6f402faa71c08342150

  • SHA512

    fabc3bd05049d2e2c94725db09db1b24332a664df789e464990b779810978dfa3704ee709952b6eff8c818afeb7be71736ec3532f18bc14f7164fd0ac3e72acb

  • SSDEEP

    384:YRYs5l7VL9skVQ42BkSv5dAsCGmqDm+jeI7GBsbh0w4wlAokw9OhgOL1vYRGOZzy:Yx7/skCXkQossqtje3BKh0p29SgRU/

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2