Extracted

• • Target

    a7670a1fa0a4e6ae82288f4e67b8cf112aa98c5ed1af25a12ceee5e345629cbf

  • Size

    29KB

  • MD5

    949e8732ab117b814097ff93cceee266

  • SHA1

    27ed08e03289abcaaa67eb4fbf1d65a199993925

  • SHA256

    a7670a1fa0a4e6ae82288f4e67b8cf112aa98c5ed1af25a12ceee5e345629cbf

  • SHA512

    81e75004d7ce62a84f3351dece338b45b476d99b870fded2827f3ea4c1095d3a035ab0ce0fca4fc6d44130fb090b9db1b5172642469151340e3e2f7a10faf3d6

  • SSDEEP

    384:5KLNl7zRVoIY6EXl53NfzGOmqDQ576We/aGBsbh0w4wlAokw9OhgOL1vYRGOZzvF:m7noIYTV7zAqM6WedBKh0p29SgRHGu

  Score

  10^/10

  njratfucked by firasevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2