Extracted

• • Target

    6af2a00d907962d68933838f21daa9c0N

  • Size

    8.7MB

  • MD5

    6af2a00d907962d68933838f21daa9c0

  • SHA1

    281dd388fa0611e35c53be1b30433f0307cdcf96

  • SHA256

    359e69eb7613c46f5b9ab94f05abe8ef25cc90971dc69f3dca7b1715f5b924bd

  • SHA512

    4676c2fc6ea1c1b2ab6c52367c017764c825c73bc690fa6139d8abd5edac261008cff019d8edbda5f417eff7c63db444871e423da0ecb2324a395e20898b7f5a

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbQ:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmc

  Score

  10^/10

  njratjjjdefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2