Extracted

• • Target

    NoThreatDetected-3fd059f263feb7754510c0dbca0c5353b99c3624b7596561654f4d70e174758bN

  • Size

    82KB

  • MD5

    dbe15b7f4f7808944b263ac56f24f590

  • SHA1

    49624e804cc2a4e623bb0bfdefc6f3b17ea6adb5

  • SHA256

    3fd059f263feb7754510c0dbca0c5353b99c3624b7596561654f4d70e174758b

  • SHA512

    f4477401464bdbc7b5f68d2bee36d57599368cf3d09944e6fdbe129ea64e1893a546d4b772eb19eb49e87b80d941aa143d3b86360453daa301f99eaf777ab9e5

  • SSDEEP

    1536:e9jD3SrB4fL5SXHBO4tza9oNqOA3Olexq:elitkLmIEzCoNqRhq

  Score

  10^/10

  njrathacked 2025evasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2