Extracted

• • Target

    Server.exe

  • Size

    93KB

  • MD5

    3715d6ae97ccefef54ecc91e874aea8c

  • SHA1

    4a690c46ffa912deb60359655a021a297fb41383

  • SHA256

    f04597d7204b14de98b22b9495e5bbc25701b51bc7e8878a8ac0d4fc5a123c23

  • SHA512

    4eb40bde8bac03010bbcacc75a61d2734a64690dfc0f5c179f4ce4311ecbc545164390307c4243b507c035db1e003cbd09bc5c38126cd078a644cfd99bf6918b

  • SSDEEP

    768:6Y3wM7yZnDQMMpAZrGSt6udttXy4sahkGJiXxrjEtCdnl2pi1Rz4Rk31sGdpygS7:6M+ZD3rGWNd7dhkhjEwzGi1dDFDygS

  Score

  10^/10

  njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2