Extracted

• • Target

    d80eba906f804ccde59353ff206e75a29f8ed135060762007e28d502ed2e338d

  • Size

    120KB

  • MD5

    2784566458b53d0541e566ec4a87cf15

  • SHA1

    5b5c958442ec21134b6d812ebc4a23e12593148a

  • SHA256

    d80eba906f804ccde59353ff206e75a29f8ed135060762007e28d502ed2e338d

  • SHA512

    a24d6b7c3313ccd26f37c82e1408707534308096ae214ac3e996a7fc08867dbeb900220834a0c3a23020437c7a856448162fe36f90771dba62ff5b7d0533c258

  • SSDEEP

    3072:NXr4D0ly84H/ua83JE3SndfNGPeoWHsUA698TENIDz:NXQH/uf3+CWm/sP69iEeD

  Score

  10^/10

  njratabo sharefevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2