Extracted

• • Target

    e119b3188fc89c92c1d35a18e5425dcf651c40da00bff2ec306c96fbd2545416

  • Size

    112KB

  • MD5

    0c1da8cabf368d5e8223d22fd325916e

  • SHA1

    3e3d14ece7a4c42020708c5517271273233405d7

  • SHA256

    e119b3188fc89c92c1d35a18e5425dcf651c40da00bff2ec306c96fbd2545416

  • SHA512

    0490f8c68855703f81e38d2f3a4d2808e8cfdff7151d8ce3557f29e5969e5ceb33a43ed3b46760b8563b4e335509badba734e59a4013449cd341e23ccd07229e

  • SSDEEP

    1536:wDK+tbdSxPWU2Z8/SDugxHI5xLcR50NYSCpjf+fdicgYdRWuvLSHTJKqO:R+tbd7Y/SPdCcrU/4b+f8cgM0i+TJK5

  Score

  10^/10

  njrathacked by -_-trojanevasionpersistence

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2