Extracted

• • Target

    8d641df289ce8544c56cbf45fc3604e44fc8bfbcf95196bbec9a18b29dbfb66d

  • Size

    219KB

  • MD5

    caee55e9143b338588c6111c68fe099b

  • SHA1

    3c3baf495319eebdb87351c112171d6f2dd42325

  • SHA256

    8d641df289ce8544c56cbf45fc3604e44fc8bfbcf95196bbec9a18b29dbfb66d

  • SHA512

    a14ddc1e8b5e7515402b77b3ec2e4ae26ae49f3eb54cca4fe70010dd3d33381a3f1b0967b279c7e4cc3abe1f08cd5a29ce6987e3074df5fa612344a3b84cb4b8

  • SSDEEP

    6144:cV8xLIQ/j6TIZNhGWaOF33OWSkkSpsBK:QoMHUHKOxO+mB

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2