Extracted

• • Target

    3477c51b4db8004874eeb950fced5e89d636b4ad123595ca403f8fca5c430498.exe

  • Size

    93KB

  • MD5

    59bc430c7e94eda88ba59fc1fa3d2c0c

  • SHA1

    7af6f4bd5d7c38ad87432785344f3016e873b151

  • SHA256

    3477c51b4db8004874eeb950fced5e89d636b4ad123595ca403f8fca5c430498

  • SHA512

    578f3b0c79a83bf85ed945dd6ff8e3f6469ce40bfbf7058849f6901a64e12719c73a98fedb3d877ac9b8e7a4fb1aa72186431f7ad933c1e705d6298d33ff2b07

  • SSDEEP

    768:8Y3Jwmm6h1ychQVHwUM7k+rhHX9/NhUQBi0yXxrjEtCdnl2pi1Rz4Rk39sGdpTgM:Nw76rCHwB4+r9ptcjEwzGi1dDtDTgS

  Score

  10^/10

  njrathackedevasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2