Extracted

• • Target

    c3d50586a7b8a148db58d99087b3352f.exe

  • Size

    37KB

  • MD5

    c3d50586a7b8a148db58d99087b3352f

  • SHA1

    58dd664f856af84b6697569312f5640d4cb9569f

  • SHA256

    548f60b1538eb59a6f7edc3b3c5533c961de5901050fd0495b75ee3305cc1278

  • SHA512

    593f997067168bd86a86a194b903b1d3e4f237f06ad3f0b6758805e05934474376a80d275355d16a14d3345b519d2fca410b1ef244b4bdf84e40c15247ca4cd8

  • SSDEEP

    384:lYraoixJ9l7OHg1WykrFV3pk8emT2JrAF+rMRTyN/0L+EcoinblneHQM3epzXaN1:Cr+R1NkrFV6NmArM+rMRa8NusZt

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2