Extracted

• • Target

    8fa0588a7d0bdc6ed5cd187ab077cdfed96f0cb1341b37e5000a5a40bbc7345e

  • Size

    344KB

  • MD5

    8d25c14a5b1f9cdf8f87b86481dbc471

  • SHA1

    af7d5f5f0f4b891b4e95dd444993138b581a69d4

  • SHA256

    8fa0588a7d0bdc6ed5cd187ab077cdfed96f0cb1341b37e5000a5a40bbc7345e

  • SHA512

    6fb3dbde57e30fa8d04f3a4081312bee32fe576b73dea496c7782a02dc82e3173d49a9dd13489d7acb879744ff3c96acc81efaabbff089354fcbbe00f3167338

  • SSDEEP

    3072:FEaNdCsfYDogE/eaBNDjh8b5hisx0x0a37K0OMwRbHpG9ua7zwo58T:FEAdCs3XLBtjhij0xfm0VKG9oy

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2