Extracted

• • Target

    e5c96ed54212f17cd507c12f18936a5900ddbbbaa2d4764a345995c0038b7c8a

  • Size

    29KB

  • MD5

    6dae13b161718a9c78fce840f1796350

  • SHA1

    9b315f094763725873e59bf4f7bc6ef1e66094a7

  • SHA256

    e5c96ed54212f17cd507c12f18936a5900ddbbbaa2d4764a345995c0038b7c8a

  • SHA512

    091e21a915a64b0ef97fad7cc06bb5892c48ad475b025b4fb7a210104797261c985db1c820da4fbdeed17be71fd3088ad9c5641796a2eb1fdfabbdf92da9972c

  • SSDEEP

    384:4hpQjtl7jBnoKoK3JX15nHK4GumqDAEReIlGBsbh0w4wlAokw9OhgOL1vYRGOZzF:427hoKoGJFNK4Aq1RehBKh0p29SgRd/

  Score

  10^/10

  njrathackedevasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  behavioral1behavioral2