Extracted

• • Target

    856ccf83da4934cf8ea09eb7d26f9a9e693a195f15d10054074f7561c2cdf960N

  • Size

    8.7MB

  • MD5

    74df16cbee80b34991d3c7679abcd8e0

  • SHA1

    a19d77d0e64078104ac59586983b9c51bd7ecb5e

  • SHA256

    856ccf83da4934cf8ea09eb7d26f9a9e693a195f15d10054074f7561c2cdf960

  • SHA512

    2460113b99ff83639eb2ac39229d77c5e445e8004e61fac1765a3fceedc21be3f3aba25c68dfbd29a500af64253895bf9c91030c89ed51c45fd80c22483042cd

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbd:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmZ

  Score

  10^/10

  njratjjjdefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2