Extracted

• • Target

    c9f5766401b3bdc79a4f2ca09f41d079982ad6aa6b925b22559bc9a3cffbd12c

  • Size

    113KB

  • MD5

    49f76ea5d8b6507e1a93d12738a0efa7

  • SHA1

    013010551e7101c4f160a12f90ac3344cb591696

  • SHA256

    c9f5766401b3bdc79a4f2ca09f41d079982ad6aa6b925b22559bc9a3cffbd12c

  • SHA512

    4022d6b7c41dd503042b823701edf2e345623dd103a1f2dfc0526c2dfe3d24f7d3aeacce780af8cb3168d6cbe0a4293bb6240c51ed9a0c7cbadff17b28ed03ac

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMg:P5eznsjsguGDFqGZ2rg

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2