Extracted

• • Target

    bee4ca532d6241e4a8554d9ba9707740N

  • Size

    8.7MB

  • MD5

    bee4ca532d6241e4a8554d9ba9707740

  • SHA1

    d82d389cb857689e3e43d7abb663e1c6dfda74e1

  • SHA256

    bb893005df8c9d2e809129f81ed6ed483f185dca9b0c295bb6b7939c020998df

  • SHA512

    eee65a949c1ebf5dc22b9e5ebd00c0bc994f3bdf4f7afb294367d90bb1abed8e6430a5e5bd8e2e84e4a7711d9e2ab8bf926f970a36f10eb7917456e98d700cec

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbq:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmm

  Score

  10^/10

  njratjjjdefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2