Extracted

• • Target

    0e75a9ec60d339fc643b40714046bb1c9dc1c1c157a44d3b94bb0b98bb41921aN

  • Size

    93KB

  • MD5

    f6f95bfaecdbfb10d9ef56a8d6cd9ae0

  • SHA1

    aa61709c0ab2a542c67d3e40535141e40f7c379d

  • SHA256

    0e75a9ec60d339fc643b40714046bb1c9dc1c1c157a44d3b94bb0b98bb41921a

  • SHA512

    720a5336c44b9a6b0bff3d37bf5bdd31a1752b25d29e232ace012d2e0233224e9568422f9a0798dae1d4b92a82024c557066f7cb1f168fe1d8a9b8cd10ce7b34

  • SSDEEP

    1536:UKLPA1h/T5+KGZ+LP+26T1jEwzGi1dDbD7gS:UKWT5rLPByCi1dr0

  Score

  10^/10

  njratсынмаминойподругиdiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2