Extracted

• • Target

    aa8a212e5d4fbc1ee64578d71a172f90N.exe

  • Size

    111KB

  • MD5

    aa8a212e5d4fbc1ee64578d71a172f90

  • SHA1

    f25619eeb1f60e4d8c535e67f9337d184ba16331

  • SHA256

    babe21e470e1facce9c24da9a29903c6180c1c56674ecb1b1b1595dcf93c30a4

  • SHA512

    6fac0c27e1f1ffcc73f5cc57df004b8ef5d9cf6696ebbbe1a54dfe60116728740e4762a9da0819cacd9da9341b42ed3454b0abd26f3bda23d11821266516b5ef

  • SSDEEP

    1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegoxmOBh73TQ:w5eznsjsguGDFqGx8egoxmO3rTQ

  Score

  10^/10

  njratneufevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2