Extracted

Extracted

• • Target

    CROCODILEJFDHJRTA.exe

  • Size

    2.1MB

  • MD5

    149f649f898409182fcad1ef424ca4cf

  • SHA1

    89098a69e94ed941385bc2ebf00cd8d3c4e47450

  • SHA256

    f5df17fe1d42b1bcb04578bc05f1ae9787d12ebb5c18cf4df18c861120be0532

  • SHA512

    3dbba29127add72bf5e4f3c7ef5e24d4f693d67b28b2650b0a2364a17274fc0967387ca860ec5d619e40c884b54af41fb9c54425e2aaaa4e3e7555d998ce9a06

  • SSDEEP

    49152:6XtCE3Q3PNxLtxcpMLtxcpVLtxcpNCCjAli9LrLtxcF6+zI:UCl1cpkcpxcpNCdCXcF6+U

  Score

  10^/10

  njratwolfhack2025discoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2