Extracted

• • Target

    124f0c4eb8f2541064a57a7a145ff389.exe

  • Size

    117KB

  • MD5

    124f0c4eb8f2541064a57a7a145ff389

  • SHA1

    18269a09370547026eec2786aeb1c2490c515cdf

  • SHA256

    af2f05611639653b5c588b25b9e42d57f53fd0262681f89f6acdc24b58887214

  • SHA512

    b0a1c753e7c3049f4ca26102d259589eb520ccf87506f821cb5b2befeb67558e61af9406542242dae82c585e006df5581d6b5ae8d2c82471cc485dcc7b027a5e

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDL2V:P5eznsjsguGDFqGZ2rDL2V

  Score

  10^/10

  njratneufevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2