Extracted

• • Target

    0120d69be07db305e8ce36d6734b061e

  • Size

    212KB

  • MD5

    0120d69be07db305e8ce36d6734b061e

  • SHA1

    f53f83048d533a7d98e4e8f99c3399b82aa4ba29

  • SHA256

    b7e1828bb63c771098cd4512ddda67a703598cd10831bc57011d832fccef8355

  • SHA512

    ced9a40c3f114cceba6dfdc1e5f053477e4565d3150c637c7391f82cb82d0e8e3375a92560ac57b9ca6f874b086f17580c70d3a16676d11841af389957849db6

  • SSDEEP

    3072:TJacj8v7wQ+ZGx7w8wjjP8I1IU8RjrzzvUWAOZjfKdLnY6:TJPgv7wJZ87wBjYI1IUwrIOZyY6

  Score

  10^/10

  evasionpersistenceupxnjrathackedtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2