Extracted

• • Target

    Cirular-18April2017/Circular.Doc

  • Size

    264KB

  • MD5

    695c5d19dc3c3c5cc39182e09d9274e6

  • SHA1

    bc0aa3fce44b7d252919d820860709a0052cb76c

  • SHA256

    6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436

  • SHA512

    a20bf0b073c43f55f9a8797e093422b2aea58949fa23e625e20ce9786421c120253cd4f988aa3b2f877d9cc7f6c472e8daabe58489d7b7ea2bec5c339e855e4b

  Score

  10^/10

  njratzalupa180417evasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    Cirular-18April2017/Circular.Doc.lnk

  • Size

    1KB

  • MD5

    f0093f6cb0dec239c81d9946380ea172

  • SHA1

    56a49a4d52b6f7fc94623c769df2aaf1b46f4c42

  • SHA256

    7818dd357bd780aae737e94f8f57b5b2cb643ceca8cc044c866d31d953ed3621

  • SHA512

    1af3a27846ee084941e4511500a6bfea5f51f97d9868e4f87711dc717a4651bde664d9ef234c2602b4def28522694a52ddc9ed6c259985a41936dac79e0f1ba2

  Score

  10^/10

  njratzalupa180417evasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral3behavioral4