Extracted

• • Target

    sample

  • Size

    117KB

  • MD5

    be2c337fdf0551ffc4abfe4385599421

  • SHA1

    0852bd21f78d09729385358f6db9d314899ffdf4

  • SHA256

    900b9c744b8519061ba55671ae1589cd215f1189eb64fc170cc7889196a53c78

  • SHA512

    7196b87b7523989157131842afd70b9943d3c446e891ea7f270b2eee9f58601be8f443838b34a3d29c1fff430c8b91d40b431c541f7ce6e2ac7b9abd2fce0773

  Score

  10^/10

  njratnowevasionsuricatatrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata

  • Blocklisted process makes network request

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2