Extracted

• • Target

    2fa422d5cd19a34ae3e8d01127e95db53e7979fe43b6f1aa12a9cf51f33eb955.exe

  • Size

    1.1MB

  • MD5

    b0e6f24c119a66f4b9ce908068d3976a

  • SHA1

    d021cfc658c963bddb74668a0148cfd5655f06ad

  • SHA256

    2fa422d5cd19a34ae3e8d01127e95db53e7979fe43b6f1aa12a9cf51f33eb955

  • SHA512

    d2ea0acff0cdf669d41b669fc81a5c889b0f17164d183ba32aa67ba93e95b9b90fcdad1ddd88462dbccf1cebb620f37f2c37e0f2f6615a9432dc5096772a5d37

  • SSDEEP

    24576:gfOjaRF0g0tYUt6bSs/6gQynGQfuY88Rq0w:TaRj0C4gvnGQfL8Kq

  Score

  10^/10

  njratmcvzlomevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2