Extracted

• • Target

    152acfcfccfe00392d27d5a954854b80.exe

  • Size

    37KB

  • MD5

    152acfcfccfe00392d27d5a954854b80

  • SHA1

    81f0a1f4d100cdd6c3025e94d57a146542ade463

  • SHA256

    a8eb99c9a5ce23bb6b9177c8fb31e873ab33bd1c6ffa6d1e0ad094d07cf05a96

  • SHA512

    1e6ba28b920736317b5a593a1d706526601ffe57fcae5294463b3e92e415e15553bb4d341a899b6f7ff60eaa78803bdc97223a3a8c4f4055f97ae7e3cbb580e9

  • SSDEEP

    768:efYl2KhhIwdpszJnq1MCrM+rMRa8Numst:eCIwd+dnqq9+gRJNN

  Score

  10^/10

  njratsvchost.exeevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2