Extracted

• • Target

    Server3.exe

  • Size

    37KB

  • MD5

    9572900a67ed67c643c7298b951d2104

  • SHA1

    e3b7291e39cafe608ffbeadba8135658d22dde2f

  • SHA256

    b9418ffff1fdc91b3257ef2c42e6edc1605b38f2534e93c4f487a72f98279496

  • SHA512

    07a115cfb2d5a97f06a10740c1e0f5ef9fb13bb248e6fbf1d7a815fe7139d7d499d4dfc638fe6544012bfa27b324535487b8446234edd4480e0b0446f8f22173

  • SSDEEP

    384:rkc6ikDRxdDsyNyyszPIRPr28msD+rAF+rMRTyN/0L+EcoinblneHQM3epzXoNC/:ADeyNBszPIRy1sqrM+rMRa8NuKgt

  Score

  10^/10

  njratabusharafevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2