Extracted

• • Target

    ac8a1912f246921d24eee850f76b16c24e917749f97a625634a1ee825df98bc1

  • Size

    37KB

  • MD5

    1379dcf7afe3f270834a611a19403963

  • SHA1

    a9c34f014fc32cc5480df9dc1d1cf56732d60d6d

  • SHA256

    ac8a1912f246921d24eee850f76b16c24e917749f97a625634a1ee825df98bc1

  • SHA512

    2fa5c178b5e77647c2ffa5a11d12412f10bb45dac7a923ea3932b4dba7fd56a9c94e06f33a5f01636bc39abfeb7d9f287331af75dd6bd148c7e03355651e2859

  • SSDEEP

    384:hYDQZCiT9SLhHGhlbJcycPxvQJIwX5iwaCBDrAF+rMRTyN/0L+EcoinblneHQM3j:uIDrJ/cPxoIw0NChrM+rMRa8NuO+tQ

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2