Extracted

• • Target

    5e0316581c455ebfae4775fe8b37bca0e7e451839553916920f20b3a7269e9c6.exe

  • Size

    114KB

  • MD5

    4be9986eb800ea45ff736671e9756ffe

  • SHA1

    e30372bd80efe2da17d21e4026ab2a42b1572290

  • SHA256

    5e0316581c455ebfae4775fe8b37bca0e7e451839553916920f20b3a7269e9c6

  • SHA512

    4fb83428ad5899f2134dad76fb4c098b5037d1c0e5d8924741fab9d75b003838b15756cd4016cdfd99da82ff6913d6d6efc7ae9f3beaa1995346ef0ef5d46d22

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMiat6QK:P5eznsjsguGDFqGZ2rih

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2