Extracted

• • Target

    5300c2a9de5bd357fd8734ca2cf6a32d1e2a90fa0c19795a155a1062419fde05N

  • Size

    8.7MB

  • MD5

    2874807bdfe1107f60eccf12c8adbb60

  • SHA1

    0491543d01e1c17503d5272f21855c0d223b5c22

  • SHA256

    5300c2a9de5bd357fd8734ca2cf6a32d1e2a90fa0c19795a155a1062419fde05

  • SHA512

    fb46c3e8c64abfc7e4227e24ebcfaf494c05d92a68f5cf7b46af2388f10bf0e37f9326bc405700e43be17c2f646f414b7c252c927a3736b55e886c6127f2e017

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbF:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmZ

  Score

  10^/10

  njratjjjdefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2