Extracted

• • Target

    b3d9bdfea091d460753d3a1b787ef95dae81a7b67ac58b8560b40efd0ce52065.exe

  • Size

    804KB

  • MD5

    891268785e8fda537a73363e1e5ebbaa

  • SHA1

    6dd788c34a3a64a5087d143a05c538ae6a2726b2

  • SHA256

    b3d9bdfea091d460753d3a1b787ef95dae81a7b67ac58b8560b40efd0ce52065

  • SHA512

    0767b072740bc814aea0764f410bb6118e1eafbbd671be382bd20431676e484adf34a983364672e0b1210b97d0f38b2ca0b8a25be424b978a8286d4c058d1b56

  • SSDEEP

    12288:iHcvn0+xAEkHcvn0+xAEkHcvn0+xAEkHcvn0+xAE/2iNcHcvn0+xAES4kDmbDm0C:jTPTPTPTt13T4mbS0Kt

  Score

  10^/10

  njratfifa 09evasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2