Extracted

• • Target

    c59de4c104876a3bf2c0450ad7fb3b981ad5053260d950e5eb651a930de2520f

  • Size

    74KB

  • MD5

    38f581a49b8c5b0934119cf5452ecdee

  • SHA1

    df9ecdbc834d20b0089a337faa6cffeedb13ce16

  • SHA256

    c59de4c104876a3bf2c0450ad7fb3b981ad5053260d950e5eb651a930de2520f

  • SHA512

    96d79cc4e4193b76f770469a0938f8e16e86163dbbc7372288f1c1a0879d8fcd618b32ac949788a06ea763ab038369d6176ccc16d71d3c00bcb8418829fea229

  • SSDEEP

    1536:2de5KBqfBlTytHtMFyMQUZDB3af1pHfLjva+x9rru4zppUcS:2dewBltcyMQUZDB3anjjvaO9rzppUt

  Score

  10^/10

  njratlimediscoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2