Extracted

• • Target

    4a12d24bb8697f0e61179bb81d393a8eaa1efd9a440ee1620b1374b778aeab2f

  • Size

    23KB

  • MD5

    806497146d738feb173729b022414fdc

  • SHA1

    c44143989b7bfe76afe487537461787d6be48cfa

  • SHA256

    4a12d24bb8697f0e61179bb81d393a8eaa1efd9a440ee1620b1374b778aeab2f

  • SHA512

    b70bf4fc613c991d6d23b92905051ffd6ef9b587991d864893caead69eeef98e5b42d3a043a71a378f9795f368c8f0366bc95e287d6088d64da95f0620f4539f

  • SSDEEP

    384:yoWtkEwn65rgjAsGipk55D16xgXakhbZD0mRvR6JZlbw8hqIusZzZIH:17O89p2rRpcnuB

  Score

  10^/10

  njrathackedevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2