Extracted

• • Target

    e1a32568a937eb3220d2c6af12e4133fac0cfd5c24cf36c75a09f98ee3fb415bN.exe

  • Size

    8.7MB

  • MD5

    c1a99d8e8044a4cacda971a3e49853e0

  • SHA1

    4124830ea4b8b517e04c1015cb33d8d405a370b4

  • SHA256

    e1a32568a937eb3220d2c6af12e4133fac0cfd5c24cf36c75a09f98ee3fb415b

  • SHA512

    c1a1d93d8b6a36e57ba6b57250f7109cef68e628479ba1019a1508e0dbc09d455e67b03f7cf2b0a965850d4b79a1a5a37b95feb23fcd25867ee7c83203db8713

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbN:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmR

  Score

  10^/10

  njratjjjdefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2