Extracted

• • Target

    ee382b41b912dbac4a0a63cef54b27caa0c69d0bd754ee33039fc6d7f13399e0

  • Size

    37KB

  • MD5

    c0d376fd24dff8ad62ec240fb4ed799c

  • SHA1

    e86cfbd87617719055efcc1e3233566ed376d113

  • SHA256

    ee382b41b912dbac4a0a63cef54b27caa0c69d0bd754ee33039fc6d7f13399e0

  • SHA512

    0ab54abf4c98154cd4b7a4206d144b51b47bf21e7b955888184737194152a97e71283f89e57efa4f327fddd91c2eff466e4b2fec92fc1a267ba27e18b06c9b2c

  • SSDEEP

    384:/LAlqiU154NLHdayszHtyPpzsobO75rAF+rMRTyN/0L+EcoinblneHQM3epzXoNX:k/ZdJszHtyxVOtrM+rMRa8NuGrt

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2