Extracted

• • Target

    5d4d2cb40386a5a31f997e2064ec803f.exe

  • Size

    116KB

  • MD5

    5d4d2cb40386a5a31f997e2064ec803f

  • SHA1

    ae48f5e63e222b32d92ac2a12c9a473186cfaf5d

  • SHA256

    2650cfb26e7feaecef2d3b0f97656bdb1d37b64b206d78f18555eede941ad871

  • SHA512

    95312ac8179f8ac93fcf0e94b8da0fd5a91a9a49ed8fa632b7409b33c771aeb619fc458f2de97993b03cd40c48cb8671f85c9532a4ff597e3fbdbf3a56c7c51a

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDL1:P5eznsjsguGDFqGZ2rDL1

  Score

  10^/10

  njratneufevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2