Extracted

• • Target

    332ab7c26dfa9b217034ac999ee8ef8916efd6bf745b1ea91b33be5f4555f5af

  • Size

    484KB

  • MD5

    f64f86668f2abc6c7cdd4ae3318c96cb

  • SHA1

    0343191d55e365c13b4eee6a4acb39248a0f05c9

  • SHA256

    332ab7c26dfa9b217034ac999ee8ef8916efd6bf745b1ea91b33be5f4555f5af

  • SHA512

    19a4abcd766ad054df93eeae68e4eb26ca992c393ad37f5cd1c371772bda89167a6b94be092b32c4e6610f7adeb1926fd1ff902de3acc670b661c28e1c18111b

  • SSDEEP

    12288:CF0zfQlZ3HMCAMwPAshor2n62NLJRpCgplxEAfhq:CywM5ogg9WbpCgnxEAfM

  Score

  10^/10

  njrathackedtrojanevasionpersistence

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2