Extracted

• • Target

    6aa69657b903959b5abdc42744653513d6152dd0164e31b8c4aaa2136ced5b5f

  • Size

    180KB

  • MD5

    0a5c7a351889c0416f63ddc78a731e56

  • SHA1

    40a628f39e9e6d5f4f3714fc62b8524941c1e993

  • SHA256

    6aa69657b903959b5abdc42744653513d6152dd0164e31b8c4aaa2136ced5b5f

  • SHA512

    64092a18df6d47dd62504978d2c4e619627652aac887422886a7c95bf424384dc7ae6949f5c83a9419bdb5dfe0b3d347f2ca64bccf8b88802d767f2b65c4a346

  • SSDEEP

    3072:RvC2jbA29f/zgoX+UNFMX1K9hLKCGb1KzdMVdhx+QPLTZypUBmbCDktybizJ:f39nzgsFIK9hZGbeMVlj4UBmbCAtgil

  Score

  10^/10

  njrathackedtrojanevasionpersistence

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2