Extracted

• • Target

    1phc1YJN.exe

  • Size

    37KB

  • MD5

    fb0bdd758f8a9f405e6af2358da06ae1

  • SHA1

    6c283ab5e49e6fe3a93a996f850a5639fc49e3f5

  • SHA256

    9da4778fce03b654f62009b3d88958213f139b2f35fe1bed438100fae35bdfbf

  • SHA512

    71d3bd1c621a93bc54f1104285da5bf8e59bc26c3055cf708f61070c1a80ee705c33efd4a05acf3d3a90a9d9fca0357c66894dcb5045ab38b27834ff56c06253

  • SSDEEP

    384:NOpYoixJbl7OHg1WykrDPf7O8GsnRlrAF+rMRTyN/0L+EcoinblneHQM3epzXNsG:gpeR1NkrDPSlsRlrM+rMRa8NuPsCt

  Score

  10^/10

  njrattrupashotevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2