Extracted

• • Target

    b71806f4fa839555a017676ad2371ede81fcc7fc2a772090ea3ac977af72151f

  • Size

    22KB

  • MD5

    fe2b09b85414dda6c35798d721230d91

  • SHA1

    0f06cd896375532a7519c6b60a661fdc6ab5b9d6

  • SHA256

    b71806f4fa839555a017676ad2371ede81fcc7fc2a772090ea3ac977af72151f

  • SHA512

    cb2e7c9d5a0566d0ba0e1c177f52f3ce75f7ca0ba2d267dd0f32652b2376869c78a86aa4b833c83928c4eb7231be212a36ad97951c4ecc2eb819ef7fc11e95ab

  • SSDEEP

    384:4Y324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZOx:HL2s+tRyRpcnuZ

  Score

  10^/10

  njratvictime 3evasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2