Extracted

• • Target

    Server.exe

  • Size

    93KB

  • MD5

    deb54ef342e3a0ec27127a3e7d652d26

  • SHA1

    e06df21ee97e502b70dc7bde782eb74207903eda

  • SHA256

    9147c7836fe827450e7f0d66e8337fbd07928a0ea19f428db38657fbdffd2075

  • SHA512

    a0a3b05849e2601c35f41f5bd6a281c012e16dc496bb6f6037cfa539dc4dc2e3d1d5bd8fdcf782a800096682cd8969316913ebd226d07a8eb66025980ca48a3f

  • SSDEEP

    1536:z9PTr1IDavlZhbSKl9YdjEwzGi1dDUDSgS:z9PSDavlZIQmqi1da3

  Score

  10^/10

  njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2