Extracted

• • Target

    0x000e000000012014-2.dat

  • Size

    93KB

  • MD5

    86051beee1e1809ccda0ad6c9f5b63a2

  • SHA1

    45b12c36e6c5cd006d39cc29cd0c87ea06c149d3

  • SHA256

    1253b452cc0b284bee02aa9eb5f36406446801aba66e354ebcca213c65ef9594

  • SHA512

    a0718e07e3d7c07801767d2ed6eaaced4006d6318d320e806df93cb3fbb28f68b6efe9847509abbbfb393652240968025134d547fd40d396fb3e8a40293f95eb

  • SSDEEP

    768:BY33bnD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk39sGS:sbxOx6baIa9RZj00ljEwzGi1dDNDEgS

  Score

  10^/10

  njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2