Extracted

• • Target

    7f9690a0ca91cfd371100be8d22540405315508650093ab356570bf236abe0ed.exe

  • Size

    113KB

  • MD5

    207a0a0f98f554f4b8ce5715f07514c6

  • SHA1

    693f287b916c2376573aeff102827961ee1352f4

  • SHA256

    7f9690a0ca91cfd371100be8d22540405315508650093ab356570bf236abe0ed

  • SHA512

    a7607294b616d99fc4f345bbcf0c038d0aeae3d207a340adccc0c20022168d71fe9e55fe3f2b0d9d8f6b00242f7995333761df3a47951ec124c9de501ca8a243

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMiaH:P5eznsjsguGDFqGZ2rZ

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2