Extracted

• • Target

    6bcb98eee02c783b3b747a7374956ea17b1ad88d2488b184348588404b2396b8

  • Size

    8.7MB

  • MD5

    5c911be7d7304255ea94271b3eebedcb

  • SHA1

    a18e31af0aea1f965f3d80ae0229546213030157

  • SHA256

    6bcb98eee02c783b3b747a7374956ea17b1ad88d2488b184348588404b2396b8

  • SHA512

    bcf76bb6018f0a743a3cb3c2266080dfd409274a5b2e28c23e1295113bfb6e4455008c46658e4a72cf4205c150d1d5f83b8688c171f631fe75a575e5f37f69fc

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbB:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmN

  Score

  10^/10

  njratjjjdefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2