Extracted

• • Target

    ea5f7b60aaf465557bedd7d88a584b8a.exe

  • Size

    213KB

  • MD5

    ea5f7b60aaf465557bedd7d88a584b8a

  • SHA1

    2966b111ca0612b39476be721a99d7d3ccca6a37

  • SHA256

    888809ab32fccff6d7521b32fdaab3825375059c9079d755e54eb390da650525

  • SHA512

    03bf2c8ce25cf9581402bdf0a8d6187db5cb0305f97470b76668751cc9704afb17382ef77b76ef3d25fd95e41c2136a25b693728dd88ca18cf12111c9da28cdf

  • SSDEEP

    3072:XJacj8v7wQ+ZGx7w8wjjP8I1IU8RjrzzvUWAOZjfKdLjYP:XJPgv7wJZ87wBjYI1IUwrIOZykP

  Score

  10^/10

  njrathackedevasionpersistencetrojanupx

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2