Extracted

• • Target

    8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7

  • Size

    352KB

  • MD5

    efde8f7c97f533dbb5f6b44412f7e0e8

  • SHA1

    32b42444d368b4531dd5b196fb8413201b876f30

  • SHA256

    8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7

  • SHA512

    9a6023d0f6d23c037c2a3bb296c328c12266a72b40d1bdf254bd901f1fe90157ff1678fcb8bee002e108a29986b05ecbc6431a1150c647decf2b57775b8747d6

  • SSDEEP

    3072:rnyCcI+02me4sZh7Bl/D8C6yi/5rwWZsRPEY9wcDkSFwVxjhC9qOf5Zad77cN/b:vvU7jUyeEmsWuTo5vsWd7pvOU7HJ7M5

  Score

  10^/10

  njratw.w.w.wtrojanevasionpersistence

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2