Extracted

• • Target

    a118ee31e68cad149975fec84cf58543.exe

  • Size

    103KB

  • MD5

    a118ee31e68cad149975fec84cf58543

  • SHA1

    b778aefc62b4b43a182f1ba75a95bdf71a19e365

  • SHA256

    456cc4e4131c6a7b6587d48148e0dc9dbb20ce34c285dc8db9dcb61f7fec7c41

  • SHA512

    4d59d8ab11b8addca07c7572384cf19e065d91e5483a06813042cf69dd3dee3737f41eaa8fdbc5f078a49db2a51114e067a56d5e08c5651e2e34b8bc2aef566f

  • SSDEEP

    1536:hzRN2ltJYXS+gRJNSJ/u+CEhWFah4CH5Oj:hz32jMS+yJEJ/u+EFahv5

  Score

  10^/10

  njratлошараevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2