Extracted

• • Target

    5311007a8d4e7b034dbe652619428aefe33bef614cc385d2d4f74f3b7c8cfe88

  • Size

    649KB

  • MD5

    fd77bce75d75a3587ed36155da6888e0

  • SHA1

    b58ad2e1cf5bca700c5ed198acbb197335f3a3fa

  • SHA256

    5311007a8d4e7b034dbe652619428aefe33bef614cc385d2d4f74f3b7c8cfe88

  • SHA512

    ca212402d0e133ca518e5d82a4375f37d2105eb2c234be0b6d571f784c86b597508626cde919c7814d343df717b5af36a4aec79a0e8b5a85420858ce63970a5e

  • SSDEEP

    12288:aJLBZE2PUOGzNmAF6699D52yjS6EGdyafJaSIMPzkqdtRbKdE1J:yLfE2PUOk6U55PS67fcsPR/dz1J

  Score

  10^/10

  njrathacked by jamalevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2