Extracted

• • Target

    e94448bcbf82be1e92fdf6a136913720N

  • Size

    91KB

  • MD5

    e94448bcbf82be1e92fdf6a136913720

  • SHA1

    50a25b28a6c1c55e207626f62c0853d97cde7a2e

  • SHA256

    fa8f38553b72c6a4d8915c9445498666d901181c435bafb2e0b3fb110fb791cc

  • SHA512

    407545317017560eda987a147eacb36bac60d1000325aac014391d97dc914e0c2eacd7ecc7cb2f8e941d96b0c7da155a249b6ddfff4791a7a65849ff967802c5

  • SSDEEP

    1536:HXnDxM2ZoXADZ9a458XeUlfkivVR1Ypnv:3nrwADZ9ajv5vVRCn

  Score

  10^/10

  njratdiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2