Extracted

• • Target

    ef5c8a793083695a015f7c29543bdd61275d9139f4071064cd18524e0f55ea02.exe

  • Size

    43KB

  • MD5

    10b81b54a24da1c7f4234b23714d5fbd

  • SHA1

    0b37bef63fe87f1b9dd0203e331978be4ccd0c23

  • SHA256

    ef5c8a793083695a015f7c29543bdd61275d9139f4071064cd18524e0f55ea02

  • SHA512

    f7cb5bd8b004f33d9372c178f2f98dc2527dca369e3202f5455b9e160a1d6763c35675de8497e59fd0f47ef8f0ccdf313bdaca85a960467ffe45e00d338eb70b

  • SSDEEP

    768:290XNR1zE4+hSTMxl2tQDmSbvQO+2d+L:290X/1zEaTsl2tQDXrk2dM

  Score

  10^/10

  njrattopherdiscoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2