Extracted

• • Target

    b8a92e0ec11d91aaa6c5c44f37024d9f09071623dcf2aa67462189e84f683b65.unknown

  • Size

    25KB

  • MD5

    ee2daced77768d937294aaf656c59e81

  • SHA1

    643fc628eb908d845c2c275492c232f39b0e56d5

  • SHA256

    b8a92e0ec11d91aaa6c5c44f37024d9f09071623dcf2aa67462189e84f683b65

  • SHA512

    9487fe759220b3c6ac22941a94fe4bbd37896ee30a06a0d5789d693a870ed2055cf6506233a75c2266fd605e27aea35e218de72653bd76d39061ceff14e3795d

  • SSDEEP

    384:5vcTzwCNCC7GepiEQceFsJoFbiOVg3Cynm6Ld2UTLrFEn768hkfH7+NpgBemOdqt:5vkHwCr89Fski7hm6L8O27U+oBLkq2M

  Score

  10^/10

  njratkulum persistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2