Extracted

• • Target

    NoThreatDetectedd0e3b116f6704f67f375d2fa41a841339f4d0efdf835ad8c167883ac238c16faN

  • Size

    107KB

  • MD5

    be2b89ec678cf36895a192c4055750e0

  • SHA1

    962af823ee68e3c44ed1d481b9975132237d6799

  • SHA256

    d0e3b116f6704f67f375d2fa41a841339f4d0efdf835ad8c167883ac238c16fa

  • SHA512

    1ab299d036535fcbcf5dbb8ccf1472568099d3ff3cc14f4f61b1f312e9c4d41810ee8004cc04bdf444d6898ceef0d16b757f2185e1ba56a132ef1ec45619a930

  • SSDEEP

    1536:2ACAY03YP1mk8TR7Xe3+LhSNJFU01kJBI5MSC63s38tbPpiHhm:ZY0q1mk8S3+Lh2OSt3FT4Hhm

  Score

  10^/10

  njrathacked 2025evasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2