Extracted

• • Target

    c34be82d4d26914808ef38f10338c6dc66da3179e70319a2362c387f770b288fN

  • Size

    64KB

  • MD5

    ab351ab86e32f9936c7943a397eba860

  • SHA1

    b11324109a190f06c068cc36d8972abd6f96fbf6

  • SHA256

    c34be82d4d26914808ef38f10338c6dc66da3179e70319a2362c387f770b288f

  • SHA512

    a8934e43aa1ae58ba07885419904cfada12b5ef99093b74d775c8993f5c32a8c413ea1af88ebf8e983c10e1ebd7daf2acba45d0e917365415f64de15e13055dc

  • SSDEEP

    768:t+w1rw9MVg/KgUA1M69FSXOfsJ8LpG8K78AQdc/LPNX2iFJNgl:x/td4toX+sJqA8K78AiKzNrJNgl

  Score

  10^/10

  njratclenoevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2