Extracted

• • Target

    1c17804c202ef0f166c2c116a1616f4c.exe

  • Size

    111KB

  • MD5

    1c17804c202ef0f166c2c116a1616f4c

  • SHA1

    3c2570d74821d28881cc8479ce46ab592895c46c

  • SHA256

    3ed2cc17203f1d0c92bda0d567ed327de37bdf1af02b082efd5806198846e132

  • SHA512

    61d384fdb2e68e7f178b9ec7a69b852d8dbd0dd655cb0c53fe9e51d72dd66066b708ae8f4389a6c47554bcfb1dc2bc69ea3d837bde45bb4f14bf0c33dc2b95ce

  • SSDEEP

    1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegoxmOBh73a:w5eznsjsguGDFqGx8egoxmO3ra

  Score

  10^/10

  njratneufevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2