Extracted

• • Target

    0ee0b78189f94c5f95f84aca68d6718554938a714157af2c939a00a5d606a7a7

  • Size

    721KB

  • MD5

    7961af50b6a6802d418e02717ec1744f

  • SHA1

    bea5538b4336b8443caadd0b4ebc405850982fe8

  • SHA256

    0ee0b78189f94c5f95f84aca68d6718554938a714157af2c939a00a5d606a7a7

  • SHA512

    d859792d648e463f77f51ea1375320adff97db4dca0c2602442329fb970651d1d8f8214e8312a0c5cb635ec62f2d59f167036d4d5dd39be64ddad977681e444c

  • SSDEEP

    12288:IQ/Z6mhgZIuDBo9dn4GgLnK2hZPSggmwQLvu/K9HLPISgd/YUQYqOKopVG60r:n/ZHhzgBCd4T1LOm92YpiZqhoM

  Score

  10^/10

  njratطلياني ذو الفقارevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2