Extracted

• • Target

    cd53a1eb080ca977a40f0d2f33dea711ac0b6ed4fc0a6102fe64a2b41c91f7f2.exe

  • Size

    37KB

  • MD5

    e42eb443fd6bf40ef9d7f2bfc76a1acb

  • SHA1

    467365bb0ef682d45c3f1664edd1690d89d56abc

  • SHA256

    cd53a1eb080ca977a40f0d2f33dea711ac0b6ed4fc0a6102fe64a2b41c91f7f2

  • SHA512

    64521ad80f984166efbbd2b2357678a6956b13607da080c1ca7c04d466b1f643abcecb56e89da7a69c57cf3bfbc672e441c023503d3e3ab2c410548a4c55ed11

  • SSDEEP

    384:7R6Iiu5jtD+P3V+y0bzif2tH5ssumTErAF+rMRTyN/0L+EcoinblneHQM3epzXtq:lRmV10bzif2tSNmorM+rMRa8NubOt

  Score

  10^/10

  njratmaxevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2