Extracted

• • Target
    2026-04-21_0bafb0e104d0b8fc77051d9a8741b346_amadey_cobian_elex_glassworm_karagany_njrat_rhadamanthys_smoke-loader_stop
  • Size 4.3MB
  • SHA256 4bd29da1265368dcb51be71b2789cc2e1dafb560ff8e38447b6b6b704bd7abc6
  • MD5 0bafb0e104d0b8fc77051d9a8741b346
  • SHA1 b792931a0acbb9922c02d98195c8244e8b93e7d4
  • SHA512 60ac12c4a65d4e7b274e3a8e3ee3779bb6f23aa6ead1619746880d3f9a8d2bf16c32f23e8d6af3a3b958f8b4e963c538ca1d705c6d8d76ab15e3866112397b53
  • SSDEEP 49152:uOYjjDXVaB655/QdPULpO3dgF8au1LuMzE4w88zGUx0+vTWDwZtNmHBE+EUtaU+f:u1vEInUULc3dg3u1yuw88nLq/3A
  • TLSH
    T1B526D125FAA488E5F113A23600478437D97B5988D04FB0673AB867454C7EE8A6F07FED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sssdefense_evasiondiscoverynjratpersistencetrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Custom signature

    Detects executables using attrib with suspicious attributes attributes

  • Custom signature

    Detects file containing reversed ASEP Autorun registry keys

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery
  behavioral1behavioral2