Extracted

• • Target

    6643c39dec501c9af408ce62b4e6b0d0N.exe

  • Size

    8.7MB

  • MD5

    6643c39dec501c9af408ce62b4e6b0d0

  • SHA1

    dfb93c997f6f199b78bafc8e99bc4632a717c81f

  • SHA256

    22cd8dcc2d8429680ca8c5ba12affd3efcab92b920079c8b1a19fdd17386afb9

  • SHA512

    2a34899dce8042dae1fa0ef972a2ce9b822d2826c02436d04cc642276157a44c57a54eda75dc020184469848212f3760072c6706a13d17f5a6ca149eff703cdc

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCb3:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmr

  Score

  10^/10

  njratjjjdefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2