Extracted

• • Target

    64eb1168ecdd149acb331caab14538d5

  • Size

    402KB

  • MD5

    64eb1168ecdd149acb331caab14538d5

  • SHA1

    cd1455c61d0e0acbe0053299f49ce639c1e3d849

  • SHA256

    78b50f821b0d995d3ef5dd0e8178b6c0a1d74c4b28779849b7d31430b239473b

  • SHA512

    3f839942b4a4ac9035087d7a82ee579c7b139d7135eee4fba9c01b5ab4a372853046d80350d1aaa65111303cc6116130cc3aa8064a81124fac6e73c000389567

  • SSDEEP

    6144:0maKVBGmE84IMNv55giU0pKiFYHxfx15RvOagakZBxkTN2gmeGcFnVQb/DAYbDgl:dSmLAuEY71fviagATFmebVQDcYc5

  Score

  10^/10

  njratpdfevasionpersistencetrojanupx

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2