Extracted

• • Target

    8339f7c21daae3fe4f3ac6cf0026b9be3cc60698f1a0ae66548d399e6a948b9f

  • Size

    371KB

  • MD5

    f688f28af59b0d3570969638f2d91925

  • SHA1

    d15a1ed7f1d20fc9fa62a6731cc398193687ec09

  • SHA256

    8339f7c21daae3fe4f3ac6cf0026b9be3cc60698f1a0ae66548d399e6a948b9f

  • SHA512

    cb8a7bfe6c5dd278d0fb58502ca4175c48d61683766a2ad2f59ab17703a465545ae309cbce27e7ac1949063c188aebbedf44f864872f47ffd846ef202c7aae32

  • SSDEEP

    6144:d/DZGeRKglYRkrcSM+FAM6nbxBWeZ/hX92:9BKglYJSXAM6nbxBWeZ/ht

  Score

  10^/10

  njratتسجيل دخول نعجةevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2