Extracted

• • Target

    gu.exe

  • Size

    37KB

  • MD5

    5623a039c27a4c274b375c83e42651d4

  • SHA1

    877caa65809f345247c37d0bf64a49b1abda1e60

  • SHA256

    87d0845412d5ad22a56954c151f0ae21cba71d2284189fdb0d3c6cb93b6282eb

  • SHA512

    3f896c083919d310b4715d267dfccf57e10c8ba67a33f4feb1a6839cb97b922868339b9f448a5ad4360229837c030a03465337ec1aaba7d4fca64b8a31c00fd2

  • SSDEEP

    768:/y0yQEkNVfCNWtkriwFYbMLrM+rMRa8NuOyt:hVqNWimwy4U+gRJNx

  Score

  10^/10

  njratguevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2