Extracted

• • Target

    eb39aa174e5a1bead3c5c6d6003022cdbc309d09820024b7cde7afc1347e7b9e.exe

  • Size

    78KB

  • MD5

    b317cc9e529037f915cebbb81e4ee742

  • SHA1

    41970486b3d3c06734b7ab9f9c6b452e2ce50c60

  • SHA256

    eb39aa174e5a1bead3c5c6d6003022cdbc309d09820024b7cde7afc1347e7b9e

  • SHA512

    b0e93264692345d20c9c3a08335e10af1dc4cdd5cede0fd62d587cb18f71393437121702f96e85f028c26b4c5c1ab38eb412e575c5264779f09d74b0f25dd21b

  • SSDEEP

    1536:RpN+BUqqDpQS5wpOk3JCK6pFNlfq6fOpd/9nEh9TGUQ6R:OQwpOk5CK6dO/9ESUQ6

  Score

  10^/10

  njratlimediscoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2