Extracted

• • Target

    39972599e9f197a89cafc40a5a6d7311bd5102588102c4b6107003cb6cc1cb52.exe

  • Size

    114KB

  • MD5

    2bc33e129d53f2d2a3a6387910d73111

  • SHA1

    567e478405352dfa7aca5da09e65ac8c679abc7d

  • SHA256

    39972599e9f197a89cafc40a5a6d7311bd5102588102c4b6107003cb6cc1cb52

  • SHA512

    0c6d82669d5d14f9fbc0a327079fc7c1ac6ebf2530933887d7298c3da2ca5988be7da83c14cbd9e12944d79cf940787869770a4ffcc7f5df261fe66192ef0df1

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMz:P5eznsjsguGDFqGZ2rz

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2