Extracted

• • Target

    82969f80e4cb9e5574aa717d2e1879d227ea14c336a8ff9e34a1bab451e60eef

  • Size

    23KB

  • MD5

    69018a611e849afae70ccca22c33a880

  • SHA1

    05495340b7803491c073673e610a74d3100ffcef

  • SHA256

    82969f80e4cb9e5574aa717d2e1879d227ea14c336a8ff9e34a1bab451e60eef

  • SHA512

    731103d2825c570962884a73448d39e6f239e12e6e23b242e0658516bb1364c86fe019563555f978ca61c8446daac050cbba57825fd2c0a3b834372e00cbe2f2

  • SSDEEP

    384:8MK6b2GZsx/Yr1+liORH1kcPFQ6Lg9gSOYRr9mRvR6JZlbw8hqIusZzZIT:vb9glF51LRpcnuF

  Score

  10^/10

  njrathackedevasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  behavioral1behavioral2