Extracted

• • Target

    2fb7fc0949aa14070e5e5d1ec37d48e7.exe

  • Size

    65KB

  • MD5

    2fb7fc0949aa14070e5e5d1ec37d48e7

  • SHA1

    9b0043790d9881f690e11086004d3218648d9c22

  • SHA256

    246ab25a7240d684c1a6bf5abd6bcd6f13e0d86c97940883bc249e2b7cb23853

  • SHA512

    13a475df0962a72f8c817511dbda22efb07c41167ebac229c7b0193a88c0f6bf383025e1327732b152d8a53ab4358d4b40d3c6f4b09cc3881165bda826e16f3b

  • SSDEEP

    1536:FIkoUoN36tSQviFw1gnRuBnvbLfLteF3nLrB9z3nNaF9bIS9vM:FIkoUoN36tSQviFC08BnHfWl9zdaF9bw

  Score

  10^/10

  njrathackedpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2