Extracted

• • Target

    bSZ5.exe

  • Size

    23KB

  • MD5

    eacb20b5a184227ae34cd5bdd8eedd7e

  • SHA1

    eaed2ff22a2fee9ed146ae0de01e9cdc6de79408

  • SHA256

    48482ccafcfdb92783fefa191740172e30ebe618f7a77704a8223047b021a6e6

  • SHA512

    3636d1b48e7ccfa8daf6647f9141f975efe7146079e5052de7a982bb36abdb6b9f86f707e030d37b41aedc6a69f8bee131be01a06a2fee01437c7860b2fb5c9c

  • SSDEEP

    384:rMKFYuEEhERvoBG16Xuy0MHNw6Tg1Y+75JTFmRvR6JZlbw8hqIusZzZON:AW4V6+yDRpcnup

  Score

  10^/10

  njratvitimaevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2