Extracted

• • Target

    9958d10f9d07d2ccd4be9beafe2f9f4cf845533fc93abd948efdb59940b97453

  • Size

    37KB

  • MD5

    07a2800cf83999d10ef1547c12b6d9f4

  • SHA1

    8f5322620f7fc368a292275c1c5faaffb7e6d66e

  • SHA256

    9958d10f9d07d2ccd4be9beafe2f9f4cf845533fc93abd948efdb59940b97453

  • SHA512

    078bf70ff41fc5120f44fd4bee960d274a808d66a6541b1afcc145c8e126093fe9f85d2c784ddb868a9d6b41b193bb44105558c3775ecfcd5c3f8255f1836eca

  • SSDEEP

    384:ZnL+Yw7BeAaXaEiVZzdmB0O4yUvPQxgp+Z2fPnYL/6qUtirAF+rMRTyN/0L+Ecor:l6Yw7bPOTUvPfI3U8rM+rMRa8NuBMt

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2