Extracted

• • Target

    de0bd57617ea6b8e3354df4d3551eb5fc01954fab7ca2f697fe0e665048eb612

  • Size

    29KB

  • MD5

    28250c94c7cfdef4561173fb79c80dd5

  • SHA1

    de82aeb67fada6f57a05519de33b0160b9cb09c7

  • SHA256

    de0bd57617ea6b8e3354df4d3551eb5fc01954fab7ca2f697fe0e665048eb612

  • SHA512

    2e707312bff0da419578793f307f65d3c5f97a1c60784855c5c5514a0b6f04d022220ec261794c46fead1488248ec9a8ee26b1c377db6e9d893fec665f6b7e3f

  • SSDEEP

    384:tN2nLNl73t5otQMOdePp5TdNZmGmqD8ZneQqGBsbh0w4wlAokw9OhgOL1vYRGOZ1:tu7jo2MzBvb4qcneQBKh0p29SgR7l

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2