Extracted

• • Target
    796ed4b0db9b3d50149b39c35c97fb22
  • Size 2.8MB
  • SHA256 37db478cd1a50883e179c601987b3a5171823aaa9d04063817fa7af57723ffb7
  • MD5 796ed4b0db9b3d50149b39c35c97fb22
  • SHA1 154fde51c43d3a8b8f1b96df04f3e97fe4c922a6
  • SHA512 762989d2993cc2431b50ae9a2847cc3b16bce41c15da9a974dd90c66884ac28b32698edbf9d13b948d7b1f22919278b43e4448710dda2b2489b509bd6ecf00c7
  • SSDEEP 1536:qfoDCSHH6dNPdeGb0kMzA1UYaER0XBi3IGd0b15grKsYmhUeogKGiGDaLm8G/BaI:O
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  njratclientevasionpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Turns off Windows Defender SpyNet reporting

    evasion

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Nirsoft

  • Stops running service(s)

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2