Extracted

• • Target

    S.exe

  • Size

    75KB

  • MD5

    45d39734b5ed25aa2a52cfc3b260704b

  • SHA1

    7119ce464ba6d11efe8f74ed11f081f28cb389a7

  • SHA256

    dfe0e78354529f20079bfab197786c46c2ef375d2b7a830a4c9d323b7b490573

  • SHA512

    aa33f8eb04389e0ee3a6786b4be4f0a8ec38270c9c725a5b35f04419744d4826126dbb940e350b47aa15a423538e0ec2e433864fcad3c271758334cff89313a5

  • SSDEEP

    1536:I3kmlzEqndxuQRg/bl8vXQgL7YarZuU7zh/ZGMf0WrxULwVto:I0mlxdEGM+jb9/Zc/

  Score

  10^/10

  njrathackedpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2