Extracted

• • Target

    10fe4ae5851e7d5403bdf1918c184c6df7016dad517511a73e946dd9816174a2N

  • Size

    25KB

  • MD5

    27dab2cc8ba5c9a4c63e20f0d28fcfe0

  • SHA1

    62b406e7a7c25569b858888e6aec463462235486

  • SHA256

    10fe4ae5851e7d5403bdf1918c184c6df7016dad517511a73e946dd9816174a2

  • SHA512

    b1b6c5004c8f4392d79640398e428074648a0dc4f86c00a390e0965e77a63564e154789b182ac03644ba55865391a6c224388d8c4a7e695e5f1d2c6ef0734888

  • SSDEEP

    384:sv3ZIY+rLwlZ0GhRSjf4mGjmhQzNksmg4Atd05hYcBSf:svpqnihRig5jmGk17apWSf

  Score

  10^/10

  njrathackedpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2