Extracted

• • Target

    f01de0a1b1360d5f3f27edac775eb5a5ce37a0f287795a82bfe825167bff5ab5

  • Size

    23KB

  • MD5

    0ff6d78e94df28d19765c982622a67fb

  • SHA1

    847581ea52d922e6938f1922aa0db562a24f9560

  • SHA256

    f01de0a1b1360d5f3f27edac775eb5a5ce37a0f287795a82bfe825167bff5ab5

  • SHA512

    22d3b6f42add725e4b844c10665e78da067a0832c2e906b9e2ca8f1d209e04060aa8e1ae2712c8bdded7c63077485ab5fa0ba1f9fa0f3dc0e0c4e14bdc8197b9

  • SSDEEP

    384:Vewz6+T4IjWZFNwXU0eiNUBdvt6lgT+lLOhXxQmRvR6JZlbw8hqIusZzZqh6:V9TbC81NgRpcnud

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2