Extracted

• • Target

    1ef58d18a795cce5b4a9b056c48349ce4d683e6f148a48d965471edf24323b98.exe

  • Size

    114KB

  • MD5

    de045d57c71ed14526140b026b886154

  • SHA1

    3909a710e8b4b93bea7ac54356bb4e3d42653f60

  • SHA256

    1ef58d18a795cce5b4a9b056c48349ce4d683e6f148a48d965471edf24323b98

  • SHA512

    294cf2c69b55063ffc42cef0664066bee7ad6d3ca8c62357dfb0403628f9a834c37e0d279331eda832564bcf2e919020c99ab6bc7aac6b694e716d31872cfbd2

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMdeQC:P5eznsjsguGDFqGZ2r0

  Score

  10^/10

  njratneufevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2