Extracted

• • Target

    c8d8f79ad37249faa03dae92947af35d310fffc28b7597507246d1f8c8eb9fea.exe

  • Size

    43KB

  • MD5

    587ad6e22bb4925dd74971fb811742d2

  • SHA1

    ed232dd2da4676de64df99bdf43d86b5049b65f2

  • SHA256

    c8d8f79ad37249faa03dae92947af35d310fffc28b7597507246d1f8c8eb9fea

  • SHA512

    552bba329873ed49765327677731fd2f99107cc2837748011dfcc792b5e9158c4c248c08d2ef6f1e70a11616d6684df4fa0068a32853a7b8eb1bd1077d56e57e

  • SSDEEP

    384:dZyBcUdsbhKIyKPDbSYeE6rrez8Iij+ZsNO3PlpJKkkjh/TzF7pWn/dwgreT0pqP:XeRiwFKrbvUsuXQ/o40+L

  Score

  10^/10

  njrat34234234discoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2