Extracted

• • Target

    d922132bd6b747e094d0ded4460f854353da88637cba8ab915038b57a2735a88.exe

  • Size

    115KB

  • MD5

    03c2cb1b508e9879356a1b50b55f40e0

  • SHA1

    a05969110ede08711d3c12c4155bfe2523f88835

  • SHA256

    d922132bd6b747e094d0ded4460f854353da88637cba8ab915038b57a2735a88

  • SHA512

    c7c9165a3adadff14526abb7afa4b7ef2d99f3cf34bc293c253a72bafa2b72dea36591602182ec4faf2003d63ab12cc4a5a199e62f4ee73540ed760beb0cb78b

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDIb:P5eznsjsguGDFqGZ2rDIb

  Score

  10^/10

  njratneufevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2