Extracted

• • Target

    aaab30336a8cb56d2e1be9284ade4f6a

  • Size

    1.2MB

  • MD5

    aaab30336a8cb56d2e1be9284ade4f6a

  • SHA1

    9e8579aecbd4f4c1a7c350b62700579158ff9f9d

  • SHA256

    e4a5cdf0d2253a2aa6ee40543ad9f7b3fcc90b45cfe3c4061e5d7b981a6de9c8

  • SHA512

    6ad7e0ca071ce595a3426779bca22bba705ce61ad7f5d414b00297b7623a218adf89973e0ab31a4b880350024a4333f8430ef19765612e9a4dcf6217ab33a84b

  • SSDEEP

    24576:qDWHSb4N0pEoGKT+CbyGbtxtKFZ2XmaHvLkpqzKIsI:584+pE2SCbVCFDyvLkoOIsI

  Score

  10^/10

  njrathackedpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2