Extracted

• • Target

    5773e88b0b55132c3b842bb1d50142926a6b15834cbad09ee3754f8b362c2bb6

  • Size

    29KB

  • MD5

    c043beee3a6c992bd5207fffa133dfbd

  • SHA1

    815960f2b40b45574e207e2c7858aadca4fe0125

  • SHA256

    5773e88b0b55132c3b842bb1d50142926a6b15834cbad09ee3754f8b362c2bb6

  • SHA512

    5091cae286f578c1898c9f6e921395125ec9e59d12792f2a1f883ef3f81a68442d744966d5b20fab57ce22d500f6c7bdfe1327f81781bc4d3a5677a9822106bc

  • SSDEEP

    384:bxUHEBl7p3hUw2s7bD55gEKemqDSqre/IDGBsbh0w4wlAokw9OhgOL1vYRGOZzD1:b17bUw2C3kEcqNreHBKh0p29SgRF/

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2