Extracted

• • Target

    shake yo dick.exe

  • Size

    93KB

  • MD5

    a535dad10d6cd4f4c2511f63fb158aeb

  • SHA1

    cd7be9d3482a016e0f72c5ba387f33a96294641a

  • SHA256

    615cce712299d6ba862286d4a7ea94f765b44f2f05b5d4f02046beba8b3791a3

  • SHA512

    16037d0cbafe06314534cb17f3e72b19f28acfa1828ac66949d162e046b92b61892d66322c24a57859657dc587c8f6bacaa7c13c73e89d721b6ab966c0b13f89

  • SSDEEP

    1536:E+AYtSUFKnOr70txlZbgoGXejEwzGi1dDnDugS:E+tdKnOr70txIXni1dPT

  Score

  10^/10

  njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2