Extracted

• • Target

    RBXFlox.exe

  • Size

    364KB

  • MD5

    35db26be771dc5ed21916b41f120b96f

  • SHA1

    9d26bc0a849efde1912f4b78dfd2a94fdd1ee741

  • SHA256

    f9b46c5b76da6de70ce500a3d03fc395da2c36b1fe3a1bc37ad6588626f00514

  • SHA512

    7f047af462539dceea48ec775c12565e0bbf101b279f42a81b8847f096d8ff6823396065a3296c9bbe9eb560408d24c413ead121df97a3fe23d9e4ac379e634f

  • SSDEEP

    6144:fgZiAEAO0sByNsAal3gVAWgS7/OhwjjN2eawlb8NwC:fgZXEAO/BUdG3gVdt7Ky0eawd8NwC

  Score

  10^/10

  evasionpersistencenjratzona loxovtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2behavioral3behavioral4