Extracted

• • Target

    3ce2612c8d59e06c0aac8e466e37efd8d07a2c4c91e5c894e44d8ec069aac668.exe

  • Size

    23KB

  • MD5

    ef3997fba7e285c97c28140e51928249

  • SHA1

    66734f8816697b868d9dd1dafb49ad1c3a153755

  • SHA256

    3ce2612c8d59e06c0aac8e466e37efd8d07a2c4c91e5c894e44d8ec069aac668

  • SHA512

    5422450cc95c23bffd47ba84acd489ac3997ffdb3851c167fb6925ca011afa0be5d0ed0a619b095cd3ee1f52ea9d14000e864b2cd577ab301ee65714cc7c1966

  • SSDEEP

    384:68aLWS0dABLYVq6RxP8MDFF09vK563gRMmJKUv0mRvR6JZlbw8hqIusZzZZr:9Xcwt3tRpcnu6

  Score

  10^/10

  njratt1evasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2