Extracted

• • Target

    7e25b10edb79b23e598357a9d138ea5e

  • Size

    212KB

  • MD5

    7e25b10edb79b23e598357a9d138ea5e

  • SHA1

    8ac0dabaebfdaba4d13035a2e44609b4a5e04bcd

  • SHA256

    70bc725d2a8756ee10547571a59f859bfd4069460bef66b47259d5c3cce8825b

  • SHA512

    aa070d8614e830fa7c54dd247a762596e55734dcd7be67be43e6130e791f5399a4e8dad427e37d547beeb6cff093f7b8e26817d6ebc3c3cd8e923691caa93173

  • SSDEEP

    3072:3Jacj8v7wQ+ZGx7w8wjjP8I1IU8RjrzzvUWAOZjfKdLnY7:3JPgv7wJZ87wBjYI1IUwrIOZyY7

  Score

  10^/10

  njrathackedevasionpersistencetrojanupx

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2