Extracted

• • Target

    0x000900000001414e-64.dat

  • Size

    37KB

  • MD5

    ab01301daa4c65810ffd2eb23b51c74c

  • SHA1

    556963ab12f90cdc52f7654e00ef2b331ac418c6

  • SHA256

    59b3dc90ef07497ef1107f75e40c3961c19f0326e2283f8caa7059fcef5b1a8c

  • SHA512

    fb22b7c830090be9a0150d789ca988e8beab0aac544cf57ce59e7d4ef66a9e548baa37df57ac529dc10c25ac308ac55fbe06abd43978668296d78df0f962ae1b

  • SSDEEP

    384:PrvsiDXT95hL5YyUvlPPnOU4CUBJJrAF+rMRTyN/0L+EcoinblneHQM3epzXzNrj:Tbv5zUvlPzVU7JrM+rMRa8NuNbt

  Score

  10^/10

  njratloxevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2