Extracted

• • Target

    3fb3732041864cba98c47ac8434d9556

  • Size

    142KB

  • MD5

    3fb3732041864cba98c47ac8434d9556

  • SHA1

    680efd0d20f38dfabcc98e287cdf1df49ee76c12

  • SHA256

    be43ffca4e5f7cb4e7ae867096328dcd214a3e780388b44d49128024e1b9edde

  • SHA512

    21e7322cd0acbad52d697e103c8d2e788985eb26248da32ee0ba20c667182f781335523ffebfe272e3c851cef0201c1ca488f0250cec54c8e8d310d3c6541930

  • SSDEEP

    3072:AM01e1SDW35DH8H214YqVXjCmByk4u5v5c1smXzl:AMGeFpDcKP2XJBykAxX

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2