Extracted

• • Target

    ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286

  • Size

    29KB

  • MD5

    42bafdfa039f7a0fc54d2cb7ec699ad0

  • SHA1

    1ae11d9e6364f59185662111da19c8888e23d38e

  • SHA256

    ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286

  • SHA512

    b9327dbbd2cbc5c79353d9f9e436edb7162292297ecd59e3e6a0254c3ece1d8e9af5b6eba72150c7b4391c6b946979d39268f07428988d6dce7a408a4111158c

  • SSDEEP

    768:KCu75oa4fu124AuhjXeJBKh0p29SgRvU5:O75CPAj8KhG29jv4

  Score

  10^/10

  njrathackedtrojanevasion

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  behavioral1behavioral2