Extracted

• • Target

    536ea76920062886038f5a468ce455392698eeccbfcd64c1a15702b4f943d4f1

  • Size

    117KB

  • MD5

    4e8d08bf55d6cf5004784e7e24f7c5f9

  • SHA1

    7004e76d09c4c0cb33c91e68230715bb4a2db8a6

  • SHA256

    536ea76920062886038f5a468ce455392698eeccbfcd64c1a15702b4f943d4f1

  • SHA512

    177e61c96fc18855a2c7f1451cc930cb81f8702f014460dd4cd02fce61af499dc0b4217744a5764afef047e0e5e8b75252cc82719057fea04ec8254b7a8dca05

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDL5J:P5eznsjsguGDFqGZ2rDLz

  Score

  10^/10

  njratneufevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2