Extracted

• • Target

    111.exe

  • Size

    43KB

  • MD5

    84410bdff65c4655bb0660f75b7653c7

  • SHA1

    5898f61a2d76158ac2dc4cb050076f3967825daf

  • SHA256

    3fdd33c095faf1845fb0b87c6636d96bb50dd73e23a21af87b4c454c1d1225b4

  • SHA512

    4a99d58eee58132eae9176ebfe1744358bf9c811a682a1d110d8baea6b615696b0cf43e4ae1144fa6b2da293967862c2c46cf7e92dd6fd70c5871910004cadd0

  • SSDEEP

    384:vZy46NUst+3gUy6jjHK6qEsjtJEzQIij+ZsNO3PlpJKkkjh/TzF7pWnFc/greT0k:RAwQh6/H1ujGuXQ/oj3+L

  Score

  10^/10

  njrathackedpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2