Extracted

• • Target

    1104d39f197f3a8cfe9a52f7d15917f2

  • Size

    402KB

  • MD5

    1104d39f197f3a8cfe9a52f7d15917f2

  • SHA1

    314939176cd3e71c92faca3057c28c9b27674b4e

  • SHA256

    8906e1ecddea0365056df3736940fbf03c5efb66bf593b5e04f847de80ac4619

  • SHA512

    ae9b2b233c1a5eb5d32d0cbe3c8c9df49a801dcb1188ea4f4fd056ba8fa755f45bfe71a3e5225618b0bea4a04e2ba6ccae03b15aa317254e2f83fa0bb26bb190

  • SSDEEP

    6144:7maKVBGmE84IMNv55giU0pKiFYHxfx15RvOagakZBxkTN2gmeGcFnVQb/DAYbDgU:ASmLAuEY71fviagATFmebVQDcYcg

  Score

  10^/10

  njratpdfevasionpersistencetrojanupx

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2