Extracted

• • Target

    7218c51ff2529378fa8be83f6ecae77444c0d85c5581c9d7f4d40dd62c318ef7

  • Size

    115KB

  • MD5

    84743b0c88be2cf9eb6874d119cd8299

  • SHA1

    5bba4db84815e84007e8828efa5ca6e46acd250a

  • SHA256

    7218c51ff2529378fa8be83f6ecae77444c0d85c5581c9d7f4d40dd62c318ef7

  • SHA512

    dce296849d40ecba1d158adbe2f672165feb02bb101bdcb911e7cf5ebe353213611d2a254bdfeeeb33a90560be535bb147df44353d9391f7a9b818d43eb7b7b5

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDLS:P5eznsjsguGDFqGZ2rDLS

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2