Extracted

• • Target

    85eb70322648b91b6731ae31fefd7307bf1243d5076a0312367461b57d4ea101

  • Size

    56KB

  • MD5

    6ec722039c95fda117a7a8e37057c689

  • SHA1

    924187760a08fe76aca2c83d222009f4310a9736

  • SHA256

    85eb70322648b91b6731ae31fefd7307bf1243d5076a0312367461b57d4ea101

  • SHA512

    4d3e947a4a7ba7306ca14dcf0c071d1ee7d7526e7fefe5f2179626ca97d781d94f7c8207a142d6e00d43d0975abbc67ebd4817360033c04a4e3e23e0ef359b2a

  • SSDEEP

    768:G/sgxcAtCL90oWAktUOqWTRHV/oZkTXyxnPurcrxT/fnF+l7R5sTgbOluT:cxc6CLeoWA5ZWTRHCZkOtzfstRe+OlO

  Score

  10^/10

  njratus accountevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2