Extracted

• • Target

    d2dfc35ba32eded5d457b40f552240e0ab80277a0627483ea03616e1cc6de726

  • Size

    43KB

  • MD5

    75d9bf5300924e732a64823a426a1c2d

  • SHA1

    c8225b5c245ab22f8ab0e879d49e14427e82084e

  • SHA256

    d2dfc35ba32eded5d457b40f552240e0ab80277a0627483ea03616e1cc6de726

  • SHA512

    373b4295f461932ab441a700272ccf2cbe6f2fa805b508a9ea3256a5481a402b8bdd6917f7c1b86d5b32b46ed80f32d818796f653f53e951050568fbfe5ccb3f

  • SSDEEP

    384:6ZyqCXvJZdlYxOsykvjgpNXyTtEahXISzgIij+ZsNO3PlpJKkkjh/TzF7pWnf/gW:Y9CXvJHuIpijgjXsDhtuXQ/o6/+L

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2