Extracted

• • Target

    1aa29b7a89feb46b0db0f62ecd1abb1a

  • Size

    402KB

  • MD5

    1aa29b7a89feb46b0db0f62ecd1abb1a

  • SHA1

    c39d23beb2cd3a626034373056755ff44cda9684

  • SHA256

    50a4f33c6dda5e05cc19b8678b2dd3f534645d71ef66439c7df9085df8a1bfc7

  • SHA512

    a915e0070d183878eb50f3c4ec56907f0ec00e0b3bad4fc0632af69384f640d0060bea77508a5a5ec2c28e674d15f59012ebd243806700042ea94e4bafe833f3

  • SSDEEP

    6144:wmaKVBGmE84IMNv55giU0pKiFYHxfx15RvOagakZBxkTN2gmeGcFnVQb/DAYbDgX:hSmLAuEY71fviagATFmebVQDcYcr

  Score

  10^/10

  njratpdftrojanupxevasionpersistence

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2