Extracted

• • Target

    77996df6c3c65280dce2b3dab44cf335c9f4e42a57b56f6100e9d568268949e7.exe

  • Size

    43KB

  • MD5

    c31546e94ffa97015dc91c1ba7e987f7

  • SHA1

    9a03b3a4a6d6f12fc0e5f66fe4d52ab307a689ba

  • SHA256

    77996df6c3c65280dce2b3dab44cf335c9f4e42a57b56f6100e9d568268949e7

  • SHA512

    6de0600e8b751a54c45d0e6eb7cd07634a036bc4b513d8156f024e042f16d121ec2c0d69e025e04daa34d452ccaca6d58acaaa9f570f580bcf21749385342214

  • SSDEEP

    384:rZyJ+FgpWoy7A3V14YiElIHAknzYIij+ZsNO3PlpJKkkjh/TzF7pWnk/greT0pqD:FfWol78V1BEgMuXQ/oZ/+L

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2