Extracted

• • Target

    virussign.com_2d39049483410c1ca95d39796f5e5f80.vir

  • Size

    115KB

  • MD5

    2d39049483410c1ca95d39796f5e5f80

  • SHA1

    bb1823bf3aec535aba9e09d13b75839097beaf86

  • SHA256

    8979aebe1dc869fc5b8ac1b53ab72350686676866c9228c07e2b964382bfe733

  • SHA512

    b2b07fcb9110352389c4e0938582eb1461109ed5c421f144cf7696e1dbc8ce1c386dbbccd75745c199c2679418ac7f8eb6fe3efd09b877093b22cb6af4283334

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDIAP:P5eznsjsguGDFqGZ2rDIk

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2