Extracted

• • Target

    520cdbc0befe9a55e23ca292c1750c163d5eed2c31f6fd6bbdf96efc6fc4aaa9N

  • Size

    8.7MB

  • MD5

    3e607eb624c75ebe3f809db0facc39d0

  • SHA1

    c70f4e16590669ddc9f97f9f5f2ea386af217918

  • SHA256

    520cdbc0befe9a55e23ca292c1750c163d5eed2c31f6fd6bbdf96efc6fc4aaa9

  • SHA512

    b41f89c1bc70b2e1f80584ff3fff9bc822c9d166784e9e6be2d78d5dc30a01ef6ec2ca0e141a1a64374233f5af6fe48d56e5aa0b9a1157315220b7487a5a4f32

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCb/:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmT

  Score

  10^/10

  njratjjjdefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2