Extracted

• • Target

    d71e25d4aa007009462676f3d35d8550N.exe

  • Size

    8.7MB

  • MD5

    d71e25d4aa007009462676f3d35d8550

  • SHA1

    0fa67da7e5e4cd1240cdebba2d78ea5c63452308

  • SHA256

    535114beaf281b57b5233f527cf2d3826d81da41de7757a87bc724a53d59655f

  • SHA512

    1054468c98324481151d60e0882c7b7ab2aff73fa83307eeefd81ac1d7c07770650015c73490e02dfd6e13e0fa77c94ce7f34092b76409ca818e2f32042edb44

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCb4:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmE

  Score

  10^/10

  njratjjjdefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2