Extracted

• • Target

    notavape.exe

  • Size

    43KB

  • MD5

    5b1db6df4c09fe3922d1b94abbbfa111

  • SHA1

    5fe5932a084e787f610d2174a170fc9e39a45076

  • SHA256

    96fd6b69b8b737d541f0de01124ada1ae2c2c07504a7c75749927108ccef553d

  • SHA512

    52d640083367ba3435a92761fcf3a566ad5089bf824d20e65c76f08046625194a412f2ecbde9b52efd2d66e2fa8513bb6b057c16904d82c532e1f46135bca196

  • SSDEEP

    384:3vZySBHIe1z1yzMDyjdDIM5NveqEGmS2DkzZqIij+ZsNO3PlpJKkkjh/TzF7pWnj:3RVVIe1zE4+hEM5NG8mSJuXQ/o43+L

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2