Extracted

• • Target

    43740f31d6b03b4967c588f75058cb066c6fd7873356e1f6daedb39f449276a3

  • Size

    23KB

  • MD5

    40cda800e43b114bb9203406ecb8c8ad

  • SHA1

    7297cac248e8ab5e40585bff16f32e21b876f910

  • SHA256

    43740f31d6b03b4967c588f75058cb066c6fd7873356e1f6daedb39f449276a3

  • SHA512

    8cb95ab8b412642bcba9a6bd2e5a47e95b65f6a20aff1bc8ad6f5cd2e1fcadcc1d1fa7234fd4fee12e42ad5b46466213f437221e2c4a9ac6df6ef395a2d41d1d

  • SSDEEP

    384:CMQ+SAN7uprgvM5OSUswZXg69gbm4hfpFmRvR6JZlbw8hqIusZzZz6:8OaxVULRpcnuB

  Score

  10^/10

  njratfacebookevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2