Extracted

• • Target

    424f837c55e7216646a63f6bbbbba766ed7521273ddfce6edad4b6335bf7a36e.exe

  • Size

    23KB

  • MD5

    043e344c6cc9477cbcfc0a483b1ca568

  • SHA1

    52c4391b1a91c828823107cdf2db92e7142073d6

  • SHA256

    424f837c55e7216646a63f6bbbbba766ed7521273ddfce6edad4b6335bf7a36e

  • SHA512

    a705ac4259f754bea7ee73397fd1e1fc131c7d74065048020f520f63120ff1fee1355b6abfea645fd1b4d4aef8ab6da6ab0ad10346854d93463672e72ff032a5

  • SSDEEP

    384:LMK6b2GZsx/Yr1+liORH1kcPFQ6Lg9gSOYRr9mRvR6JZlbw8hqIusZzZWe:Eb9glF51LRpcnuq

  Score

  10^/10

  njratplug-inevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2