Extracted

• • Target

    xV0aWLFtJKKg.exe

  • Size

    78KB

  • MD5

    5658dd93a8379d6c46126a380ceb8b50

  • SHA1

    4de37a6d63ebd5f89a96eb8f832c12dbf21c38ce

  • SHA256

    8539d8e44e928a23ef872c5a8ad4d4e632c9f489a013a5b29d36d15ac2767b61

  • SHA512

    a355e0e5b0c8b9933233951758d63fedcf4c8813b84ba9844334e4b6c2eb5b30566294bcb5fd33f6684576b77175369214f2f469a66e0b6647331f81c93dafee

  • SSDEEP

    1536:qpbXx+1CmYDp2S5wpOk3JCK6pFoETQ6fOpd/9nEh9TGGhJcR:OwQwpOk5CK6pO/9ESGhJc

  Score

  10^/10

  njratjunio777persistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2