Extracted

• • Target

    04b83cfb61645ef6aed2768b17841cad50bc34d31ac4c8311fae8a6038b23cb6.exe

  • Size

    37KB

  • MD5

    18b7b51ab055f7af12a53b1d2dd63f95

  • SHA1

    c287aaccf3d40d08fce75a85932a6f8dcdc72565

  • SHA256

    04b83cfb61645ef6aed2768b17841cad50bc34d31ac4c8311fae8a6038b23cb6

  • SHA512

    5cfb295a3cdcabc2954133b0763caee6d70e918b76f3fde63148ddcf978e8c0ac73b56ed47afd5725c851c0d034e407634b47b87999e422376a09acce817ff48

  • SSDEEP

    384:Z3Gwkfsgwi+Jx3+j/NSyszkoAXVs3G6aBrAF+rMRTyN/0L+EcoinblneHQM3epzk:Npkk/CNhszkoA+26OrM+rMRa8Nu+ht

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2