Extracted

• • Target

    5457dd383ee30081111dac45f5701512a5496fcdaef3e0e63caac90598a7ef7bN.exe

  • Size

    87KB

  • MD5

    670c8d22e8634e5ecc068bcc602d2670

  • SHA1

    3d0969a03dcf424aa880202721dfb4dd32c0f06b

  • SHA256

    5457dd383ee30081111dac45f5701512a5496fcdaef3e0e63caac90598a7ef7b

  • SHA512

    49e683290adac6f74ebec720e823ced2f9b2c6d20151389ffeb4337c6a258d15c213f1bf97cac0b2048fc3b90aeca1820e9c7a3b139e8a8e4852ac65011abffb

  • SSDEEP

    1536:FrbII78KHCbUv4rFjxJOEGJs2A1LEwgnY6ko:FrbIE8KibUv4rxxJemhWbko

  Score

  10^/10

  njratmohibevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2