Extracted

• • Target

    94e8fa6dac6e1a9e76dabf84a2478626eb9cba660c3a9dbe525caa7271fcdef6.exe

  • Size

    25KB

  • MD5

    2dff234d815257b3cec6c671f59adbd8

  • SHA1

    9e61b93827619f545e56e0dce967166105d9659d

  • SHA256

    94e8fa6dac6e1a9e76dabf84a2478626eb9cba660c3a9dbe525caa7271fcdef6

  • SHA512

    5ea83782bcc35aa3e9abd355017a88deded529d8f95fcc854f9bc7f3be12d72cb318e77172c9af87358432ec5f1f93e32d52b759b42ad88257569700d28ee154

  • SSDEEP

    768:5vkJ2tI9rN28sZIyLLoT6t5Qa+tAgzyyKb:yEtkB2SIv6aTz

  Score

  10^/10

  njratzulapersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2