Extracted

• • Target

    4a5fdda9ee07e884e1d89612b56a932acb9c812b72cccacde885da0f9b4eab31.exe

  • Size

    23KB

  • MD5

    26f75dde198f77866dbc6167cc101f2d

  • SHA1

    056d49fc62c8ce9efcedf4ea3e4b8b357e3a23f9

  • SHA256

    4a5fdda9ee07e884e1d89612b56a932acb9c812b72cccacde885da0f9b4eab31

  • SHA512

    a42ca275b2f6ea334adab73a63adef6da64acb8b1663b3658d33c21f187ac1e0ec1cbe2d5b935c1c0c8da024979bf57ff2abc6b610b74aec956ed66a615ba77d

  • SSDEEP

    384:D3gexUw/L+JrgUon5b9uSDMwT9Pfg6NgrWoBYi51mRvR6JZlbw8hqIusZzZ5Hoz:7IAKG91DP1hPRpcnukW

  Score

  10^/10

  njrathacked by jmrhevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2