Extracted

• • Target

    559d282b0ba15515ba2b906da3d68f60ec4bcb0934d07d7e922f34909a378707.exe

  • Size

    23KB

  • MD5

    4834daaa2464378474669c26607f8c55

  • SHA1

    0798e7d96aaaa629c232ad4398a307e25013d585

  • SHA256

    559d282b0ba15515ba2b906da3d68f60ec4bcb0934d07d7e922f34909a378707

  • SHA512

    20757819ff1eb2b63155bfbbc983e1e95e4bb0eff6aad703db6cb557f89c6ad26b48ae090367539219dab58b2bf8df2574c7dbde206b60e63c58e5b16d62386d

  • SSDEEP

    384:tY324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3tVmRvR6JZlbw8hqIusZzZo69:CL2s+tRdRpcnudG

  Score

  10^/10

  njratzayan1evasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2