Extracted

• • Target

    96cb6cc90619a599c9806d649a64db4aa596c495887ae3b3db432e63082bd0ab

  • Size

    592KB

  • MD5

    f9af3bb471626b0b164883fd40364984

  • SHA1

    2134dfb0329ed567be16aded8da7bedf9d65f588

  • SHA256

    96cb6cc90619a599c9806d649a64db4aa596c495887ae3b3db432e63082bd0ab

  • SHA512

    e0f0c447c37b57caff29ae54f99b1ef37a9416a7fa03aa15f0f66c0e7a279a495c54e768527845ee900af95e76c8c2607053c85e30d7ff85fe0a1806e6fb7071

  • SSDEEP

    12288:b2y2axB0F+IKNDleyJJ5KcZDOIOcMldpFU065lbzO4mBR:q+xB3ZL5NDzkdHUphNmBR

  Score

  10^/10

  njratspameur montaevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence
  behavioral1behavioral2