Extracted

• • Target

    eb1d92eb4e8a4cf0ba8d106116f18775268be557ec4557565a7c55ee80fd6ea5N

  • Size

    118KB

  • MD5

    2dac3a64a90ba07e4bfe9cbc2d798cf0

  • SHA1

    f7022fd081b637ef837eb1a8fdb09ce5a8001fb8

  • SHA256

    eb1d92eb4e8a4cf0ba8d106116f18775268be557ec4557565a7c55ee80fd6ea5

  • SHA512

    4aff4148047d7882cbbbc0797ae1a3ac6eafcdaf5ddd24d7d70be38fbdfbb88b486d34f183ade02d6aae808a996061f7c66cce7fc694b10d5aae4fee34421c33

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDL14Xx:P5eznsjsguGDFqGZ2rDL14Xx

  Score

  10^/10

  njratneufdiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2