Extracted

• • Target

    3b85bff29b551c67997a4e763bf2da6463538fc6697f6e162daf1a6de9f9d636.exe

  • Size

    116KB

  • MD5

    b6d002079290cdd6f4c05eea7db27ad0

  • SHA1

    fbc42b4d3a1f84deb54fd864e28e1215e6e78ced

  • SHA256

    3b85bff29b551c67997a4e763bf2da6463538fc6697f6e162daf1a6de9f9d636

  • SHA512

    c63d6761785021c3e9be5b7807071876c31e183f5cc670f842c9c40bac13d56500730738d034cec4af27e31159535e61cd01669031658036caa8f7c9b304a9f8

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDLZD:P5eznsjsguGDFqGZ2rDLZD

  Score

  10^/10

  njratneufevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2