Extracted

• • Target

    35a04499338ae3ec8b0df0afc7b1fac5e052302ff0f16a18df9368bfc78f354d

  • Size

    29KB

  • MD5

    51fc62ebbaea37b188705ba73f5a76af

  • SHA1

    021a0cc05bc7ccdb8efb832147881a4e64812e88

  • SHA256

    35a04499338ae3ec8b0df0afc7b1fac5e052302ff0f16a18df9368bfc78f354d

  • SHA512

    9839dcb4d5885ca1e152e6b826dffc5cd23491d2aeebc01036473a9bd4ed7839a8372ca886ac8c73dd28563b5f4c10a98a58bc4fedda0f71bf5494ae9f3ab752

  • SSDEEP

    384:dZCINl7rZt4AgSTnd5fGmjmumqD418+eYKGBsbh0w4wlAokw9OhgOL1vYRGOZzq/:d/7v4AgMdgmjAq8XeIBKh0p29SgRMl

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2