Extracted

• • Target

    b5363483ba7b2652d75139e8f5c7bc57.exe

  • Size

    37KB

  • MD5

    b5363483ba7b2652d75139e8f5c7bc57

  • SHA1

    7bd1e7f6c1eefaf78674b407b297c8e84660eb4c

  • SHA256

    0cfc9ae5544a95eb98751dfd0bbe0b38a7b383e782ddc4ed70b060bde5e3e366

  • SHA512

    bce313a8364c6b3f20b496cc00cc194e8a2270616fe882830e11815530346a4ff531b48744cac3f7d2da79335392ef307fe2f792e701a5e5a0b9ab40dce63867

  • SSDEEP

    384:jkTMUiDHblmJEpRGyEfBffXuKCYyEEcFsrAF+rMRTyN/0L+EcoinblneHQM3epzv:YTqHpR9EfBfWKClE/srM+rMRa8Nuf/t

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2