Extracted

• • Target

    c9ab1615da4eb661e347aed48b91b4b1490322bc6a3a743cf87657df38150d1f.exe

  • Size

    114KB

  • MD5

    051fbfff157042910851c479f8f54069

  • SHA1

    035006543e908813d46f5ee95fb0f3c54af7e701

  • SHA256

    c9ab1615da4eb661e347aed48b91b4b1490322bc6a3a743cf87657df38150d1f

  • SHA512

    ac582d3c3b666323aa29f96aa3574a1ffa3d7bca140608fbf8b22150accac8bd504e9dda4940694fcc2351b3099aa0c57b969438e949df5ae8dad4f6b57dcf4a

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDwT:P5eznsjsguGDFqGZ2rDwT

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2