Extracted

• • Target

    5846a4f316160ded59379aaecc48de08.exe

  • Size

    103KB

  • MD5

    5846a4f316160ded59379aaecc48de08

  • SHA1

    b5af1332a27e9e7a70b85dded3ee294a7b6b2446

  • SHA256

    2ca10a991b5151eb236b4faed3a08e7f44153286b53dea588f888dc0174af8a3

  • SHA512

    ff43812896e14b9efecd00a642fd374e4d60fd4f9389a620b9c85138f757bf950677cbba102513a2cfc01f5e1990f04e24cb1b6ef7fe055829cae8fadca3d93e

  • SSDEEP

    768:NAY1lN7oYUGF6DrM+rMRa8NunC6tRJghs:NAY1vcdGMc+gRJNV4J

  Score

  10^/10

  njratgeforce experienceevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2