Extracted

• • Target

    4011c945eab342dfa34f753fb98a8903

  • Size

    65KB

  • MD5

    4011c945eab342dfa34f753fb98a8903

  • SHA1

    abdf5d45451977d0aa451b34947de4459fe01c2e

  • SHA256

    af5fd63b145516de0fe79e709e30099e24f5099d0415c5ecff07b94e5f03ae7b

  • SHA512

    fada3b5a3370ac17194f9646e933c4c00735ba5ec30ae6abc7546bcc506d4ddc8474155add6ab6b4faf4963080d51791ecb25c05a677b3c042fa7b980dbc609a

  • SSDEEP

    1536:sEikUQ5Ke31oeYUnqmc/5arJpG96UzodEtp6ARiOm6Ozx:sE5rl/Nq9QIz8A8OmRx

  Score

  10^/10

  njrat⋘a♆a⋙evasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  behavioral1behavioral2