Extracted

• • Target

    4b3953db788e94a8684de4ade7427e9ff90c479a9031cedb9a699c465259eda7

  • Size

    29KB

  • MD5

    d06838731d941cb6345ec574ff669a9a

  • SHA1

    06d5b57cf6669adf9196bdae4f106e79d8c23207

  • SHA256

    4b3953db788e94a8684de4ade7427e9ff90c479a9031cedb9a699c465259eda7

  • SHA512

    013c8275ce9581f051eeb9901ac073ea1817f5ffab87ea2a2a93e2574d566e501d28a8883abb382679cdd6f83759c5df48007d131a3173dce6a0f0444ed4cebb

  • SSDEEP

    384:mYs5l7VL9skVQ42BkSv5dAsCGmqDm+jeI7GBsbh0w4wlAokw9OhgOL1vYRGOZzj2:a7/skCXkQossqtje3BKh0p29SgR1g

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2