Extracted

• • Target

    272807e29879a6d16fd18eed2e7ff7ea.exe

  • Size

    114KB

  • MD5

    272807e29879a6d16fd18eed2e7ff7ea

  • SHA1

    79dbc3bc456688a5eb6e11443d2e756c069a74fd

  • SHA256

    f1ee6a26a415669c195bb842fad2d0330776d9e8544a406ba60837c5f5d45e2d

  • SHA512

    5767ad38c4a8dbe79bb979acdc7f0c0ae87f708a1b6dc8099c2a38592ab7dea031e35b5fd467e48262510b93d3af96e130a3f83622b53c1611218e4f0d35e365

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuML:P5eznsjsguGDFqGZ2rL

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2