Extracted

• • Target

    70f646b09ff32a6b94c00759fa069364eed50e953c03253aa135d01554d6a315

  • Size

    29KB

  • MD5

    ae871bf63f61f075b9af4956fa145094

  • SHA1

    c9b0426e340c391d7fb7783715a28e46e2018a59

  • SHA256

    70f646b09ff32a6b94c00759fa069364eed50e953c03253aa135d01554d6a315

  • SHA512

    3222d4b21c3958165dd178ca010a858a3f63c998e8d639be069ca65e65e2901e002f7dc87f066f94f9e22e9352f192929109771797e98cae5ec018aa4e1e9adc

  • SSDEEP

    384:WUHEBl7p3hUw2s71L5NQImemqDWPHeSIUGBsbh0w4wlAokw9OhgOL1vYRGOZzFZ7:m7bUw2CtIIIqAHeXBKh0p29SgRXJt

  Score

  10^/10

  njratahmadtrojanevasionpersistence

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2