Extracted

• • Target

    DLLinject.exe

  • Size

    43KB

  • MD5

    d45480663e5b74794425c0ffe354bbee

  • SHA1

    45fecd5d4512dd86464e36e63d459b95ffecfbeb

  • SHA256

    482b4f745d80925974ef46ab24bc35d1c7f895c2881820ebef14fe5f1117a072

  • SHA512

    f52e73bff29e8fc5e25b3325e2ff7967a3589d1c090ec0fa03f931a1276a664f903713b5363222e930589ca018464e84b123caf03bd2541876ca2b2b77760634

  • SSDEEP

    384:XHZyhv6QNkli0yiQHJSNOW0eytTEjRqrVGzkIij+ZsNO3PlpJKkkjh/TzF7pWniV:X5W6ABiIJSNOW0e6ysauXQ/oH/+L

  Score

  10^/10

  njratassaultdiscoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2