Extracted

• • Target

    4ab8fe1e78032e7e21bfc7f9ffb4dac1

  • Size

    402KB

  • MD5

    4ab8fe1e78032e7e21bfc7f9ffb4dac1

  • SHA1

    81234a22190d834c6959d3e4164f2d359ebce34e

  • SHA256

    79e3ec6c521fd939a66b44cd02e87772412cf065f8a247a0da5856df54b3efed

  • SHA512

    8ce68c92f29d26d1b85dbbc9b2690c7f04e4193683c5aeee89976e7a44254a235f9ad2c0531e4bb9a575334b08eaf9312cfb4ecb2b7b3061d7636cb2513c197b

  • SSDEEP

    6144:hmaKVBGmE84IMNv55giU0pKiFYHxfx15RvOagakZBxkTN2gmeGcFnVQb/DAYbDgU:mSmLAuEY71fviagATFmebVQDcYcg

  Score

  10^/10

  njratpdfevasionpersistencetrojanupx

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2