Extracted

• • Target

    55915916a6f71c1b978973adf8e6d1a6e5f5a5e18f9dedd7cedf384591140d1d

  • Size

    115KB

  • MD5

    22cc623e15f2df325dbce6730817d7f7

  • SHA1

    9980838ec6f9f67ab5477fe9ce035e8ed9c659de

  • SHA256

    55915916a6f71c1b978973adf8e6d1a6e5f5a5e18f9dedd7cedf384591140d1d

  • SHA512

    c3bfc068aad49cf72123fac77b501d2e1b7ce6ace3a8788e66261ef22c57ab4b47e69cb34bf7fa6293c3e064a9a018f76d8f5b0b86ef44dd8dd8502d0da1cde2

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDI5:P5eznsjsguGDFqGZ2rDI5

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2