Extracted

• • Target

    fbef397f7b9e59defe5c9dda20598ea1e61c50b515c067f16fb353765beb8516

  • Size

    20.7MB

  • MD5

    1c26f1a4ee0ee14a776f10eff0a7f652

  • SHA1

    776be5867732f91bdf587420e87ea3ccea075dc5

  • SHA256

    fbef397f7b9e59defe5c9dda20598ea1e61c50b515c067f16fb353765beb8516

  • SHA512

    5b9675a48ca762262afe062cd46b3d2e996e8d13bd80bb1107b3a33995a217b87ba3ab3a6e82eae3ac36f745ab5f5b5f56e36c01fdf2fd79c6b6f9c52d0eb5a8

  • SSDEEP

    196608:DgRrd4rYBFH179k3qxnWcdoT+u0XRZTdbQguI8gh833xxaMfYky:0FH1yuW/+tdSI8ge3Ly

  Score

  10^/10

  njratbaslayalimdiscoveryevasionpersistenceprivilege_escalationtrojanexecution

  • UAC bypass

    evasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2