Extracted

• • Target

    c65ca4f6d2c653e18e0d795ba0cb0c89.bin

  • Size

    65KB

  • MD5

    c65ca4f6d2c653e18e0d795ba0cb0c89

  • SHA1

    543c228d35fb48b5b147aa47cab2b76ef9e6c19b

  • SHA256

    d094b3e64b1ac779565c1819f7f1b4041b5fa901e74f0cad9d3d376c506635d9

  • SHA512

    b3e5b167372f41210c15f9907f4cbfdbb62cdec5b3334449b2e7d178b57a10f21cb189461080f1298d6bc9f7468acfab84dde6402184a8d5600458c2ac1a16e3

  • SSDEEP

    1536:jU+u2LoN36tcQviFw1A+HIBnvbwfLteF3nLrB9z3nUaF9bkS9vM:jU+uIoN36tcQviFC9oBn8fWl9zkaF9bU

  Score

  10^/10

  njratnjratpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2