Extracted

• • Target

    1e39c64ba850b0298ab04b9e9c2f69fc

  • Size

    402KB

  • MD5

    1e39c64ba850b0298ab04b9e9c2f69fc

  • SHA1

    1e5f7671e54aa8597ffb3af7fb13e2d0aeaee318

  • SHA256

    5ca60c222235db8fcffbd475e7ed5a8d477e7ad251c30c289de58f743750f2e3

  • SHA512

    e849cd145f019820b188868c04b3b01bf0f072695350b6fc69025831a68c368979ae7a5756f72a13f7903305dbe1df6fac6f993c63921ff6c32b541580a989b8

  • SSDEEP

    6144:zmaKVBGmE84IMNv55giU0pKiFYHxfx15RvOagakZBxkTN2gmeGcFnVQb/DAYbDgl:oSmLAuEY71fviagATFmebVQDcYc5

  Score

  10^/10

  njratpdfevasionpersistencetrojanupx

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2