Extracted

• • Target

    63a426782ec8ec66f046fa20a0da67fd1b12529b530a4b4f42d360183d69e9e3.exe

  • Size

    33KB

  • MD5

    4353ed6964bca8a997b8b101b2c27c14

  • SHA1

    eeeb0c4cdb143621c6a37caafe42b145a4d30e2c

  • SHA256

    63a426782ec8ec66f046fa20a0da67fd1b12529b530a4b4f42d360183d69e9e3

  • SHA512

    cd8541f5a133c3f7b3e7526ee0fec8a6e4c8438997ec1827aac2bdc5a05e7244341fc87476a78673ab2d58d4e4ca30115f6d74444c32de0746f4aa4b5b00f7c0

  • SSDEEP

    384:koWtkEwn65rgjAsGipk55D16xgXakhbZD0mRvR6JZlbw8hqIusZzZekjamn4Sg3f:T7O89p2rRpcnu82mn4P3UX8cO

  Score

  10^/10

  njratvictmevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2