Extracted

• • Target

    d8ea408260319428541bb48eb7fb0ad9f1c115d0faa243aefc27c28399eb5277.exe

  • Size

    208KB

  • MD5

    b074e0cc3c448376b30b4f65805bb368

  • SHA1

    f6f2c8e3d3066d72087aaab74c28a905a44858af

  • SHA256

    d8ea408260319428541bb48eb7fb0ad9f1c115d0faa243aefc27c28399eb5277

  • SHA512

    3e1cbf1ffa14614cb169e819bae5bdcbe54d96db3cea418c9e904af25d0d8bdf0b02a2e95d8ed2223a6e7e3e26336462327b4f54a9b94ef1c3f9c381583e4402

  • SSDEEP

    384:3DVUq67iFRNItImlQNYlEi0jWro5kqNKk1d7U33r+Y7DTP6juEfU5PZQhht1XKvO:3pUZ7iFfuITm+5LdqHSjumT6vmp+BIl

  Score

  10^/10

  njrattelegramevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2