Extracted

• • Target

    90a3ee4bb184d38630de9018450ed6be6fdeb2e6b562ccd04fc88f0ad0c865f4.exe

  • Size

    43KB

  • MD5

    82a9a2a48d290eea02ea5f46a8f31dfb

  • SHA1

    dc20b8cd4f74b9a63cf2d90c5cbbd21839945c89

  • SHA256

    90a3ee4bb184d38630de9018450ed6be6fdeb2e6b562ccd04fc88f0ad0c865f4

  • SHA512

    e3988c2ee085cf228603f70b54eaadca3a9ba5caa72661eaed7eb20217042b52c2539bf77bd4c40e7165d02bcdb605379c94f279fa671beaaaed49b59d5cc833

  • SSDEEP

    384:/ZyvvGyCEFmVoybL/ldP8tm8wMxEDMghm19D9O5UE5QzwBlpJNakkjh/TzF7pWng:BOvGyVAVlbL/l5knuggrvQO+Dl+L

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2