Extracted

• • Target

    89afd81cb7cb59382bf5830fd0111fd79a186532d960242e2e7e079415850ba0.exe

  • Size

    114KB

  • MD5

    43b54cfac304eeaa653ff9ffbe260427

  • SHA1

    b65b4fb9a6e70f74dc34b2d5c474642a13e84222

  • SHA256

    89afd81cb7cb59382bf5830fd0111fd79a186532d960242e2e7e079415850ba0

  • SHA512

    b22fb5408f1412922e61ba0a1a73de9bbb7361490686420dfb0cb3542c202e8f1fa320938fb1ae2b8c39701dc151e73ee0dd883954f91c11e7640afe437d2277

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMiat6Aa:P5eznsjsguGDFqGZ2riAa

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2