Extracted

• • Target

    4dcf194e1ff0da85f69c0aeb423e9483.exe

  • Size

    114KB

  • MD5

    4dcf194e1ff0da85f69c0aeb423e9483

  • SHA1

    4586e748622127dcdf8ce9bff2a7f97a885437cd

  • SHA256

    33aee37671d9e67a24846380d63a0a15cb03335a2d07f52fc5c1b1066bf1d90f

  • SHA512

    0d4b6a78874697d725003974e3dc5a56063562930437d9c3b1406622c99cb6bff646a182e1b5c51cb271bf269bfef6de117ecd0cd80747ee4df79bd38503f67e

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMde1IZ:P5eznsjsguGDFqGZ2rYIZ

  Score

  10^/10

  njratneufevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2