Extracted

Extracted

• • Target

    70edbf6d01029edd6329a1a01091a21fb57c19b4171ff8021405ade0ebdbcf2a.exe

  • Size

    92KB

  • MD5

    d2fe48b6139405269f194f1c9da8c94d

  • SHA1

    bce75393d5f9a1dd4fd55c579d3e68f8aaea9838

  • SHA256

    70edbf6d01029edd6329a1a01091a21fb57c19b4171ff8021405ade0ebdbcf2a

  • SHA512

    9f63e8872d49ea09bde18eb1181ec5c849b098b80562de09cfff66b4d99adf5f6a4e187ed654261c0096503f693cfbd423828f1bdb74f7650c88748a1ac5a05c

  • SSDEEP

    1536:607nGfBulrp69O6+kp36hjQ58WCmB3cFwzvkc/9:/nGfBulU9O6+kpVztlewzco

  Score

  10^/10

  latentbotnjratdiscoveryevasionpersistenceprivilege_escalationtrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2