Extracted

• • Target

    452353fbe08dc51dae969986cd6cc85f0723dfa58bca689a231d29a651b2ac2aN

  • Size

    8.7MB

  • MD5

    2e9eb3cdf49cc19926f728f060fb63b0

  • SHA1

    6b24e89f59e7adb624eb2f5aeb1dbed48f19f053

  • SHA256

    452353fbe08dc51dae969986cd6cc85f0723dfa58bca689a231d29a651b2ac2a

  • SHA512

    6bacf720010175ddd3252be8ba7afc1d0624404c4680936ba0bf3ffa63c1dbbe2dba8347ab5ba843c394cbddd1d6e28192c8974b06861f127fabc67f3441e2e3

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbI:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmk

  Score

  10^/10

  njratjjjdefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2