Extracted

• • Target

    1196190fd68b5e363107ec9f6bdb5a3859b6cd315f72392d64db552ead0fb89b

  • Size

    29KB

  • MD5

    29866996e016e6f2f3c9cc814807b3a8

  • SHA1

    606306bae6a956be85c37a9ea22b2475abedb149

  • SHA256

    1196190fd68b5e363107ec9f6bdb5a3859b6cd315f72392d64db552ead0fb89b

  • SHA512

    fd8c1d8b27952a26e34495ccc7da8be885405cd9caf69ba3be1ee5725325cc76869b3f33d47df593c99cb1dd0cfc5793907194b222a24138d9010de1b057c4f8

  • SSDEEP

    384:Ios5l7l7EMrof6oyh75NxrimmqDWD4IePUGBsbh0w4wlAokw9OhgOL1vYRGOZzdL:07GMroyn5prsq04IePBKh0p29SgRZ/

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2