Extracted

• • Target

    ChatgptHelper.bin

  • Size

    36KB

  • MD5

    b50645ca6885b8f2dfd3571eae7afd1e

  • SHA1

    2bc22b2fe4b75825deff008634390661b7802de5

  • SHA256

    2a03b714a7d8a52e79746c1bb5fd0a08615f526d6390272d5678fa452846840a

  • SHA512

    cd7eb7f8bbd4d3b30d7fd3d51f57f2202dbd3949463ec225df6b5c4c64f3cad9bb0f4e173c996cfde570877edf23600937ca5eaba8180083d92d9c83019338c0

  • SSDEEP

    384:of+Nb7LsikZ9zNf/1uyU71evdjsOaP0rAF+rMRTyN/0L+EcoinblneHQM3epzX4F:lNf4l1lU71e9FacrM+rMRa8Nu2Pt

  Score

  10^/10

  njratevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Program crash

  behavioral1