Extracted

• • Target

    b76c306555758842c5ac0b225cf691e74f6b00bc557d59f3ef1e26a1da9ccb30

  • Size

    29KB

  • MD5

    50ca65d9ffa021117d59aadcb728c010

  • SHA1

    adfe0be4770bf13da68a1e73d9b66a417b8b98eb

  • SHA256

    b76c306555758842c5ac0b225cf691e74f6b00bc557d59f3ef1e26a1da9ccb30

  • SHA512

    f28696963fc15d57341c5df22997b09453afa1cfd7c42293967e3afacd920656726307518b3fb7a6c71e377fb19df27cd3e47c3b5978d18da5b1a78a2035a9b6

  • SSDEEP

    384:JhQXpl7dzns8oDw/LRP55/4GWmqDSeXegLGBsbh0w4wlAokw9OhgOL1vYRGOZzJc:JE7Js8oDSJz4wqZXenBKh0p29SgRxG/

  Score

  10^/10

  njrateeeeeevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2