Extracted

• • Target

    79e5d298dc3a064466813b4ca761eab93ff2309dffe5d00542e51b94aed7d186N

  • Size

    8.7MB

  • MD5

    5a3454dde694d054caebebfa44739e80

  • SHA1

    43c6821b072afeab1a3dd824194890636dbbed16

  • SHA256

    79e5d298dc3a064466813b4ca761eab93ff2309dffe5d00542e51b94aed7d186

  • SHA512

    df87549a78773d35e365816a30ee54228ffd6dec2aaa40e838ae5fe72f8ff7c5c683b51e1f7e15ff3d3b4ed0399c7746d760a5eed8ff777f97d01ce7d6ce9dad

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbH:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGm7

  Score

  10^/10

  njratjjjdefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2