Extracted

• • Target

    905dad7e9a57d7569f32b4bb8908f62954c784204f640f650966a5ec5e1338f9

  • Size

    8.7MB

  • MD5

    0ba6892e146f9f39c493a83a90d42a93

  • SHA1

    7c2f6a255d1dfb6a52056a578f4eed82f8343125

  • SHA256

    905dad7e9a57d7569f32b4bb8908f62954c784204f640f650966a5ec5e1338f9

  • SHA512

    4051b974bd9bf1e185903f7057f8d52759430959130015c3d95a25469d31d5ed0d1eefe62683bdce687e6fe24e90174e3f972edec7a2e8c91c788d1af10ad89a

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbY:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmc

  Score

  10^/10

  njratjjjevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2