Extracted

• • Target

    1045bc3c220894a5af59554c73aa39bf.exe

  • Size

    109KB

  • MD5

    1045bc3c220894a5af59554c73aa39bf

  • SHA1

    12098de1eb22cbae1d450349874b114cf00c894a

  • SHA256

    0878ea566ab7bf507460d2e99ebd3fc3ca63d53c22e7cabc180988161d143aa4

  • SHA512

    9e5e615d133053d76285f8067c31cfe83091017eec9de58c8d428c7c61f61c7dd8c62dab77d6d7f4491882a490fea728d3c87ec9e2993b21215c041f88dc5029

  • SSDEEP

    1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegoxmOBh733:w5eznsjsguGDFqGx8egoxmO3r3

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2