Extracted

• • Target

    d5f936e0948611fc301c4ca8b85fc1012356a3f6f83e09e7c959087a4d5d6442

  • Size

    23KB

  • MD5

    5a8b08e5b56260b53bbf1222e3dda7b3

  • SHA1

    f035b6f669365f18329406c036d9428019cae1c4

  • SHA256

    d5f936e0948611fc301c4ca8b85fc1012356a3f6f83e09e7c959087a4d5d6442

  • SHA512

    6236b614444c293c8aeae0bd16d33ac48c6e8e299ff4004e3448a1a2a048c992a995012d94b0f0c767cdb686ded8296a41ec219d5b0c4ffd29fa73912602a706

  • SSDEEP

    384:zQeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZHjd:k5yBVd7RpcnuC

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2