Extracted

• • Target

    27726719fef9353269c479b5bdb01668751bfb9efffd9f8b13b28d197fa81630

  • Size

    23KB

  • MD5

    5d1f987ad69659638904af6fc6ae7ac5

  • SHA1

    d789bc2c58728c3768e32564eea64441c9766f4d

  • SHA256

    27726719fef9353269c479b5bdb01668751bfb9efffd9f8b13b28d197fa81630

  • SHA512

    fcaabb9db9cda1769bd7824f0cd0394d7051307f35e52c69419f1eaf07524f762227f917a6fc93e6eca373cb1fd23c529ac138e272f4d5471a38ef34222bc937

  • SSDEEP

    384:pQ+ILgIbOprgPsUOSU0kB1kd6dg7GYh/J0mRvR6JZlbw8hqIusZzZEE:cLL6MVU0pRpcnuW

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2