Extracted

• • Target

    37eadb2a6a140992e449eabfb0835d8f

  • Size

    402KB

  • MD5

    37eadb2a6a140992e449eabfb0835d8f

  • SHA1

    77cc4134b54cc4a07624e7b332713a08b7efc617

  • SHA256

    4a666cb1c605e9318e069c60f68589c67eeb6b30c49975a9189f15f2a6aab463

  • SHA512

    d521f6cb1ab2723bafc5093eb69c326ce65f48a6961eddb8107159663e60104cf38d9baaea18013939ced450d0e8b63960619f2a40c7cdb715226da51b769e24

  • SSDEEP

    6144:kmaKVBGmE84IMNv55giU0pKiFYHxfx15RvOagakZBxkTN2gmeGcFnVQb/DAYbDgW:NSmLAuEY71fviagATFmebVQDcYc6

  Score

  10^/10

  njratpdfevasionpersistencetrojanupx

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2