Extracted

• • Target

    ebef7fb293665916480c94ed4867f973995a46248b1944647571ec5ef67f2dba

  • Size

    113KB

  • MD5

    923f7f7f3535f2fe2851eb2429a7b0e9

  • SHA1

    4ae271a1518bfbafca8d5d3601ec21d317944724

  • SHA256

    ebef7fb293665916480c94ed4867f973995a46248b1944647571ec5ef67f2dba

  • SHA512

    cab6d7f4df9f8de70f31f9829edccb459eabd81d8f5f71597fe669b879ff44d56b66a8ce7cd2a0efd96c719f4a93728de01c557e781261591980362448dbd7ce

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuM8e:P5eznsjsguGDFqGZ2rn

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2