Extracted

• • Target

    0b6d2b4bf74a0048a6d821df552c051e057b0da06e1fab32135aa69a48d767c3

  • Size

    23KB

  • MD5

    f38eeb8a929f0c74c244d08f4f8a18c0

  • SHA1

    d42402a74afe51da9382ce886480e2ffa13d6b9e

  • SHA256

    0b6d2b4bf74a0048a6d821df552c051e057b0da06e1fab32135aa69a48d767c3

  • SHA512

    b18ecfcc8dee4c72f464622df142044281bb1f310ee4606d9cb45c090db496e5342dd94fb554f7bda7ddba6e11acdc005a0e581673eddf6e541973646bfb8c68

  • SSDEEP

    384:MMQ+SAN7uprgvM5OSUswZXg69gbm4hfpFmRvR6JZlbw8hqIusZzZ7Fm:yOaxVULRpcnu7

  Score

  10^/10

  njratfazhakerdzevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2