Extracted

• • Target

    ad21777c9591c33b563a53115f9db9461899805dfe9c73a690463074fa9f12cfN

  • Size

    128KB

  • MD5

    13c2a0a9fbc1649da8c50ce26b292440

  • SHA1

    958b633948884bebdaaec097495954ea181b5702

  • SHA256

    ad21777c9591c33b563a53115f9db9461899805dfe9c73a690463074fa9f12cf

  • SHA512

    efa1527c3c14934124299cea35f6b7822c2cf4ec04d8872b275f4e68370618c6323095df58a403cbd4d61866f8f8c7997da13ef42ab40f7e1caf8b63c5254648

  • SSDEEP

    3072:H42ScHsJXC/Uij87CW70PX9akYAMTxLkwJgt1aedys9jjYLde:Y2SdcJDak9YxLVgueXx

  Score

  10^/10

  njratvip@dump evasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2