Extracted

• • Target

    2b2d14a5b497f65d1735160bdf5b67a74dfdd2ed6f46ba2fe7e30cadf8598ecc

  • Size

    360KB

  • MD5

    759e169a84546b211620d22ddb801874

  • SHA1

    e9a651979706d5270ecec31ab43fe9d687c4868c

  • SHA256

    2b2d14a5b497f65d1735160bdf5b67a74dfdd2ed6f46ba2fe7e30cadf8598ecc

  • SHA512

    5f01f33d3c935c533b971d1dc6cb5b7eae8be6a2a7be2b6699f3f8f6e45dc5765ae7665f00e2c10768a7baba7ceac45b5580a4fb407c5262493b30032904cc4e

  • SSDEEP

    6144:Oe20iBi8M0yAmr6DGQedTSkeaHSUh7iONZ2x/EenVHPaLLJmh9fxqnZepp9CJ:8xihLr6DJ2L1ph7MFCLLJIqmp9

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2