Extracted

• • Target

    c688771d462dd43de49442bc6297db435c3138dddb7625e4d2fccb145463ac22.exe

  • Size

    34KB

  • MD5

    24b2856cb9840f3b7131827e32cb73c9

  • SHA1

    306e69487143bb3756cba328f20aa55a3482c38c

  • SHA256

    c688771d462dd43de49442bc6297db435c3138dddb7625e4d2fccb145463ac22

  • SHA512

    8fef74742bca9faec30c144e9eec5e8fc4ac8f6d1fc1f680a2cf278c6511e6d1d11746e882a406b0cc2d79194a31c16e523930cc8f2866617c2f6232dc20b3e7

  • SSDEEP

    768:b717qEQ4Un/guyq6tZ1f+escElzYcHeIm:b717Q4sDF6Z1mesbEI

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  behavioral1behavioral2