Extracted

• • Target

    b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223.exe

  • Size

    39KB

  • MD5

    5a6e0971a54847d4cecc16bf7fa44bca

  • SHA1

    b0b5d4f2cfe7a64addb17796ba41353c57a57f91

  • SHA256

    b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223

  • SHA512

    90362f72a78c257eba31a9bc5089d02db626a985f78d5ec8f97dadd743ef4c2b9fc434f318faea27d0e41e03cddeec94536f5bcd29a1ff77f14fe2d44a8b823e

  • SSDEEP

    768:VvAl92nMe/UYPlfk4l3QYp6LxybXDIAfjP/m/NyE3NSTM8udmmBDnu:i4DzPlfk4JQm6L47BfbIyzM8udmmFu

  Score

  10^/10

  njratuzbekpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2