Extracted

• • Target

    23dd4610693bb9928f8c224440ad8e30N.exe

  • Size

    1.3MB

  • MD5

    23dd4610693bb9928f8c224440ad8e30

  • SHA1

    2bd398fbd6bb00801a5ac15650afcff4e3b7ee8c

  • SHA256

    35b588651334998c6473ba19b676527e5e4782a5d366e5aee5f6151e927ef1b5

  • SHA512

    9b3f635e105c41dd93f806cbe09cd73a4585f26ed6ff349d21862fdd4d3990e3bc701a0199eed9969eb101691a8363234e67f134a4d86ac397ff528276970c3c

  • SSDEEP

    24576:tfZlf2TdDY5LI6jrXDHt4D4lfLBSDm9kN4wIa7LwQVZjI6jZZjI6jVqOb/trJYwZ:TeyBgV

  Score

  10^/10

  njrathackedevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2