Extracted

• • Target

    b510d18d2aa0a1c6e1f268fa888454d7.exe

  • Size

    287KB

  • MD5

    b510d18d2aa0a1c6e1f268fa888454d7

  • SHA1

    6fa648be32432436ac88b5461a01a535b60a2892

  • SHA256

    9b128bead261e37e627633f1c1eaa0e242f0681b07074badfc03c0f59120a5b2

  • SHA512

    7e285b8d164633e82291a7089dccc9f37ebb364c87b6de5ffa2cd5cd0da701de998f01f43f82e8d612d262f8a163b1137373a4432eb95a6a8aa92243942a1bac

  • SSDEEP

    3072:eU0c0PAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZZZZZZZZZZe:6+GIIIIIIIhIIIIIIIIIIIIIIIU

  Score

  10^/10

  njratgargulecnaraciespoofevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2