Extracted

• • Target

    Server2.exe

  • Size

    37KB

  • MD5

    eb58ab61b4f6752137b47922b3fa3a21

  • SHA1

    df08cf24715c89aa84954587080b87d7ad33e56d

  • SHA256

    e74dfaa4c10425645b96135ef379febb8fd5a822708da089d22b98b9739cc844

  • SHA512

    bc1d4743b452c9a2cf6abc7b597b1b7a8c9993beb608f958b5425a2bb910e9e4b48c9c6d036ac32fba1474f0d0de7645313c20e71ea8684f866afdc1e2b438ed

  • SSDEEP

    384:z0BqiUD54NLHdayszTbUfblsWs7PrAF+rMRTyN/0L+EcoinblneHQM3epzX8NCnm:IhZdJszTbUh1szrM+rMRa8Nu+OWt

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2