Extracted

• • Target

    Server.exe

  • Size

    43KB

  • MD5

    d263ae994c7828269ff7d3a5ec76a11b

  • SHA1

    4c9dcda66fd3004be1b8e1eec4f397ddea9962d5

  • SHA256

    1e429092e09d2f72fbe28209ea1bd98d65fff4e9a7bb6e5cd7986196b30a1f98

  • SHA512

    93051cab42a41be27724206c321bff81a5389e6d4bb7038f2d7fd1bce6dd14ac9c3c1bedf48b0e30c88e0e8efaff557a26e848ef24e408799ab7738be3ebdc53

  • SSDEEP

    384:lZy46NUst+3gUy6jjHK6qEsjtJEzQIij+ZsNO3PlpJKkkjh/TzF7pWna/greT0pe:vAwQh6/H1ujGuXQ/oj3+L

  Score

  10^/10

  njrathackedpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2