Extracted

• • Target

    1b467e17131e0cf6d421ee6becb1fccc8961920cc40c7cb7e6356d6ced243d5a

  • Size

    22KB

  • MD5

    11d80e08b8d92ce0084d5ab11dd5c6af

  • SHA1

    70dbe3680bafb0c51623ec4cbd4b493c1a7dd675

  • SHA256

    1b467e17131e0cf6d421ee6becb1fccc8961920cc40c7cb7e6356d6ced243d5a

  • SHA512

    79875085a0407e262dcd7359ac6d784bacd7fcfe4010830fa7d5656f6b0943bbffbdef432b2ff9638814a483b8773391508b87004a2930f814f0ceba8a9fb10c

  • SSDEEP

    384:Pc6ze6e1PAhJVzC3tC1im/BsTx46PgZ0rap9HBmRvR6JZlbw8hqIusZzZvVy:te9EJLN/yRpcnuz

  Score

  10^/10

  njrattestevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2