Extracted

• • Target

    DLLINJECTWORK.exe

  • Size

    43KB

  • MD5

    75f876f184505cc110923210adf581cc

  • SHA1

    2670bf9724001fd9ba1370682c8deddb22d1a35c

  • SHA256

    18d57def8a8508e9767383a47b26a31d30b4ed1d4fadc260d61810f32ea14a13

  • SHA512

    345c6cbeba7d3db55dee9a4717dea12b32693b19f8588920e2841330ba821fe0fb85769c26cb4b3050d1f851b3bfd26ea14b3dae24be095658243141ae151f74

  • SSDEEP

    384:GZy8tFgpWfxyiihvhAhjEhHSLizYIij+ZsNO3PlpJKkkjh/TzF7pWnD/greT0pqD:c7tWofYiYhcYy4uXQ/oO/+L

  Score

  10^/10

  njratassaultdiscoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2