Extracted

• • Target

    93e37b1a0f0ee27897560217fd9ee7da7f2e6cf9e94d8d6052a58d58715611af

  • Size

    8.7MB

  • MD5

    e6666d1ea0cb9eeedf3f9ea6d654f899

  • SHA1

    db0a64e5085ff3c4555652fe05b535a3d3cb3fbd

  • SHA256

    93e37b1a0f0ee27897560217fd9ee7da7f2e6cf9e94d8d6052a58d58715611af

  • SHA512

    c3623eabc7b2a15006e9c01550eab627f51a2f3c2e46e04a278683fd7028a433bf3bd311b73ddbbd08aaf711b96c9b36872ce2d720ebf209376238bc51306308

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbG:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmS

  Score

  10^/10

  njratjjjdefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2