Extracted

• • Target

    d01b47718e114d8bc0edf992f5f9a640N.exe

  • Size

    6.6MB

  • MD5

    d01b47718e114d8bc0edf992f5f9a640

  • SHA1

    1ed8b7a230b9bb088e27c54855dde042de2549d3

  • SHA256

    f0910ba026973659443e0334916e971742595929e873e953473818269ae6640c

  • SHA512

    d4f46131a5f3936611b8b37e02539a2836bfaa3f1ffabbbc309e0de5e91006837f65c7acd467cf008c5be09d7114d9ca7b4fe2b8768c4925eff8c0efa9c8d610

  • SSDEEP

    196608:PelMj0Z9elMj0Z9elMj0Z9elMj0Z9elMj0Z9elMj0Z:PehZ9ehZ9ehZ9ehZ9ehZ9ehZ

  Score

  10^/10

  njratsqwickdiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2