Extracted

• • Target

    86ed2da2a6fe73f34d92e63da55d9439

  • Size

    132KB

  • MD5

    86ed2da2a6fe73f34d92e63da55d9439

  • SHA1

    02823118771ac1496b8a73bd15ed0a02c388ce6f

  • SHA256

    d7e72572160952121642ef404a994172e8997012282d3a0aebf9afc881748bb2

  • SHA512

    cd4b7aba61fa5107af11cf6a1fea55003759ae91bca949ed411597c2a1ad6380ac6bda3d66d996dd5876d9dd9f278180f463b2c9025874b05e67b71f017797ee

  Score

  10^/10

  njratnyan catsuricatatrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2