Extracted

• • Target

    f02c84e2280759e7a2a5e707582611e1ea7b28597ebdfc39b0cb23363d00b09e

  • Size

    23KB

  • MD5

    20919f85bf91c4683bd92871ecb89d2e

  • SHA1

    f03ca16c1e9cc3ee54ae874d05e3c69d36e978f3

  • SHA256

    f02c84e2280759e7a2a5e707582611e1ea7b28597ebdfc39b0cb23363d00b09e

  • SHA512

    bd167942f2a05a5ff8985ed3ae09723982ba60457e75cd8309bca6b9a736836baf3ed36378bebd1ced36988e1809334aa2c86b057bf10a8f6ec7dc953223d0dc

  • SSDEEP

    384:bluBPiZCMfdfSJrQbsLRGSIxYVL46pg/i8BD9BmRvR6JZlbw8hqIusZzZlkU:kOmhtIiRpcnuo

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2