Extracted

• • Target

    76b1f4848c021092f8a0444d97f8303d2be473faa25827604c0ad093c40156e9

  • Size

    29KB

  • MD5

    ab4dc3a101d43970c605f514c755018f

  • SHA1

    77d550ab7f6064cd9ad4e1d948a5ec3cf24b94c2

  • SHA256

    76b1f4848c021092f8a0444d97f8303d2be473faa25827604c0ad093c40156e9

  • SHA512

    3b9c3fe69a5af0b771bab200c023a8e7655e1c08286375ccf6421e91335c9aac4d2e66d7071cbb26acd67e5b10f349a51c229a69f3133ce32166a554a087e235

  • SSDEEP

    768:LK7ZW4Oakw1BJX7oqsKuelBKh0p29SgR/t:LK78KEJKLKhG29j/t

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2