Extracted

• • Target

    1b10bef23627d776d4038e05f01e77b49e527a45b798824515b20e30f6d8c5a0.exe

  • Size

    8.7MB

  • MD5

    4e9cf11c79ebcfac2f4b998380b4b0e0

  • SHA1

    7c66916108c1987097a92da216dc7dac17c563b6

  • SHA256

    1b10bef23627d776d4038e05f01e77b49e527a45b798824515b20e30f6d8c5a0

  • SHA512

    1998a2e0201d9b8fabb323604c0ddeb2bf290b93b113aed413acdb1711b0ce20f211b34a40720a81cb9c9e28bb2bbe401428713d359e21476a3bc428be7d1976

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbm:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGma

  Score

  10^/10

  njratjjjdefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2