Extracted

• • Target

    a9f841256176e553989ddda571efbd826e7a1290ccd915344e5cd7f3dbff0e06

  • Size

    29KB

  • MD5

    539fc0ec68b05fe7516850d6408ba0a3

  • SHA1

    7851bcf3001ea1f930da624663f7f9f311ee1571

  • SHA256

    a9f841256176e553989ddda571efbd826e7a1290ccd915344e5cd7f3dbff0e06

  • SHA512

    acbbdc29bb4204913736e0147754c621d1ec216a9174000fc4f58ed3238bda9c316412ead0d35f5f797ea2d31d5bfabb8160d5aa0d3474f8d72c3e256c6fe102

  • SSDEEP

    384:1xUHEBl7p3hUw2s7bD55gEKemqDSqre/IDGBsbh0w4wlAokw9OhgOL1vYRGOZzSe:117bUw2C3kEcqNreHBKh0p29SgRk0

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2