Extracted

• • Target

    ef69707a68da5915b4c43ebadc69dcd9bdfae8a65658ce94f85c6adfd1562cf3

  • Size

    8.7MB

  • MD5

    b2ede5de775bb44be1657f992d534171

  • SHA1

    fe68174133a6c18b5f748174a6fcf65d45610596

  • SHA256

    ef69707a68da5915b4c43ebadc69dcd9bdfae8a65658ce94f85c6adfd1562cf3

  • SHA512

    809cee9314d792cd8f98932cd9c170aba1ccdff8c5a79f41c3f5b548bec2bad47077cccc5c7d2515b87a65690e0ed98a96117814726b180a917af3473ab7192d

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCb6:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmO

  Score

  10^/10

  njratjjjdefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2