Extracted

• • Target

    0f7b9313f0229b4a2fe163d42a3a6e794333e8ec15c3a2aa7755b2029b3cc98fN

  • Size

    8.7MB

  • MD5

    5513855bd936f6e123347b1b9f2cae50

  • SHA1

    aafb1fd832b0ee05fd59739d2c8c7d9cb1393c1a

  • SHA256

    0f7b9313f0229b4a2fe163d42a3a6e794333e8ec15c3a2aa7755b2029b3cc98f

  • SHA512

    de3f7ffb76d36e524d8849cfe68f9ceccce370c8a399712c5328d35a6e3f1dd65e1cab574eeabf1034c169c89e414c2627c8191fd2d012371c7f60f1851601bb

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCb5:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGml

  Score

  10^/10

  njratjjjdefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2