Extracted

• • Target

    downloadf-5984vghm1-rar.html

  • Size

    17KB

  • MD5

    d6fa5fb91e78e7e43a66729cf87665ff

  • SHA1

    ea3765b6c84bddeb8a006463621e699fd413097f

  • SHA256

    81fbdbaf4a7ed22ef0829ee101a808a916e023f74b370a108869770037c61ea3

  • SHA512

    4b9d0e95643770f04e51cdeca4af17b5e6bd6870c406772a7e2336634ba1073db0d269f90c6f204f9845272be55d2a9f0d330ff33915ce12577835ad8d10b99a

  • SSDEEP

    384:BfRIjUDGO2G9kLL9jl+dVchxMhZCUtiPziMKxv0uldCjw/vZWrFV:BfRIjUDGO2G9kLL9jl+dVc2cLKxXdCgU

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2