Extracted

• • Target

    1c1e6128738f90d0a77248880efd9bc9b9255d5a5625b05fe609ced943de900a

  • Size

    641KB

  • MD5

    0f90df5bc5729687c185b625c884173a

  • SHA1

    5c313bd0d43e9fc04de3be43546bf598a741c86b

  • SHA256

    1c1e6128738f90d0a77248880efd9bc9b9255d5a5625b05fe609ced943de900a

  • SHA512

    012a1d3160cac0f076d2ca00ba0a01f6e6d99f42e184cc3dfd5f5366d44642cb1fe0995bf7311f0428cad472df58544fd89265ff0865cbdca2117f0c015eeaa6

  • SSDEEP

    6144:zYQT9dfbLIqMIgGkQ5wwa4RoqQtvlsOk0pM/SbURs4joY5iyk4AAoOQATLo:Ecdfbsq7bip4RdSSEF4Dib4z

  Score

  10^/10

  njrathacked by mohamed hanyevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2