Extracted

• • Target

    3e124508b39b68317375be75c14e7ff8.exe

  • Size

    115KB

  • MD5

    3e124508b39b68317375be75c14e7ff8

  • SHA1

    b885c4facabfd60e597857f45c97a3a4b47dcc29

  • SHA256

    ff4501dcfc5f1f6ab5c50195d053191d54290d2efc160def4de7af2b2c1f7039

  • SHA512

    81a35f10a3adfa1635c0957c69f9a0e6688e1e818144169696e018a0c0bc62b3196c3e5930216b0fc81cd68b0441261b5cb428054bad8a7b0e2b56a122e06670

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDL0:P5eznsjsguGDFqGZ2rDL0

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2