Extracted

• • Target

    3cf7a73ff94fa6896f0818d26e5d7e9d68546e0f984b6280c441d8a39412489d

  • Size

    115KB

  • MD5

    66fc20e0656c22a485daaf9db6f44a2c

  • SHA1

    af07a7a9e73d8643a51d8677742f2ea1c1ab1279

  • SHA256

    3cf7a73ff94fa6896f0818d26e5d7e9d68546e0f984b6280c441d8a39412489d

  • SHA512

    96ce7a2e3609ea766aa4ee9567f731a772c03239c5b156e34b67ab332dc839135b80dc58a4519466b575fe5e0d3f63198c4ac04ef8b965b94356e569fad19720

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDL9:P5eznsjsguGDFqGZ2rDL9

  Score

  10^/10

  njratneufevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2