Extracted

• • Target

    Device/HarddiskVolume3/Users/Usuario/Downloads/d88d9478a3df86f3aad088f1d93e25f31eb9ad74a01f087b1a4a9533daf25fa6.exe

  • Size

    93KB

  • MD5

    333edb223d980aa62d38eccece026ce4

  • SHA1

    96dcf76040ef3db4e5fd04f6e5f572a20abb6404

  • SHA256

    d88d9478a3df86f3aad088f1d93e25f31eb9ad74a01f087b1a4a9533daf25fa6

  • SHA512

    8489721a0cd9b1bda528b460d62e79b5b79484a8b34760915c7d9d8b3d2951e30f8d9bef2ee6061be4a729e73982161175e6eace72e1a07e3494f9f1be33aa6d

  • SSDEEP

    768:xY3B+xFKghFchQVTqWnwz/1h3XE/blTzxXSsvXxrjEtCdnl2pi1Rz4Rk3OsGdpyD:u+nK6bTq8itNEhVhjEwzGi1dDKDyzgS

  Score

  10^/10

  njratserverdiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2