Extracted

• • Target

    NEAS.59262f5d8d272d320c444f709992bde0.exe

  • Size

    23KB

  • MD5

    59262f5d8d272d320c444f709992bde0

  • SHA1

    3758c5e043763a377615ca6517c3b54d4e1c5758

  • SHA256

    c1fbe53d8a15eca3fb56a2a95e34b2bcc98328cc2ccef173f3320a59b8277ac8

  • SHA512

    2c9dc2f6685741980b41d5bafcd650b633474767e5dc297fb7e057d98de50a4fe65358e1b039e3a7ce9008a97c052904fad54dcc36b0fe9a607b4a6800bff719

  • SSDEEP

    384:AoWtkEwn65rgjAsGipk55D16xgXakhbZD0mRvR6JZlbw8hqIusZzZI9:P7O89p2rRpcnuT

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2