Extracted

• • Target

    97d710673f7ede7e94bfd78383f76dc13db96b7f0997bf267a4ca40a9edaf6c1

  • Size

    29KB

  • MD5

    e60917239623e9b7b6e0f5b879c88ff0

  • SHA1

    71a3c06515241b14227ca3a0131134da1c4dc747

  • SHA256

    97d710673f7ede7e94bfd78383f76dc13db96b7f0997bf267a4ca40a9edaf6c1

  • SHA512

    446ce1d1e69f7cfb15505aa5dceba3d8a099cade946935f05cd507080bc41e325e27963267f7c3f0a22821e6b2121df914ad058c55549a0de1ae8c4c8d36ae83

  • SSDEEP

    384:mYs5l7VL9skVQ42BkSv5dAsCGmqDm+jeI7GBsbh0w4wlAokw9OhgOL1vYRGOZzj:a7/skCXkQossqtje3BKh0p29SgR1i

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2