Extracted

• • Target

    a043bfa7b151ac31e609a0245748e027.exe

  • Size

    37KB

  • MD5

    a043bfa7b151ac31e609a0245748e027

  • SHA1

    f943edb4d73001d699957dce0eccf8662245a14a

  • SHA256

    bcfa2d821757722293b60b92c321f29a8f1cb0662fcc724395715c55c7702980

  • SHA512

    c15f912654cf9e0558329fabb3df657678b385d4c05884228527f32fcb4eb3a8fd35b80ac962ab92d2bac3f11687626cfb74128038fcb75b4d21a944cb1c303b

  • SSDEEP

    384:XrU2eQilChHeTnMDGyef9qhxTe9/6ZurAF+rMRTyN/0L+EcoinblneHQM3epzXMC:Y2VSMD9ef9qLg6IrM+rMRa8Nuy8t

  Score

  10^/10

  njratвоваevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2