Extracted

• • Target

    e8b30fe51545f3a3464e20f020574791c5525ecc1b2e66c96ef96f7fe871a010

  • Size

    23KB

  • MD5

    355db377b53d99e5fc1445e25d4c243e

  • SHA1

    880c2496355e289946e02cbe870b7d48f56a9e3a

  • SHA256

    e8b30fe51545f3a3464e20f020574791c5525ecc1b2e66c96ef96f7fe871a010

  • SHA512

    6a72db71d190754d7e1bd36ffc54ebb3b92e2134256368d180e32508e947636b1ef641b5eda02dad9183e4d93e2bd21cec3df6aa4707b7c498f367ddfa626659

  • SSDEEP

    384:2MK6b2GZsx/Yr1+liORH1kcPFQ6Lg9gSOYRr9mRvR6JZlbw8hqIusZzZiqP:hb9glF51LRpcnuN8

  Score

  10^/10

  njratmrakhafevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2