Extracted

• • Target

    9bdbd794aa81073836e9b8903dc3dd3f3d141361ac289cbd78f0c20d9e224d74

  • Size

    23KB

  • MD5

    26f5357f3d1f5cf588f0037e47ff507a

  • SHA1

    1feb416dbc2be71eecac5b1d42ef042a81189595

  • SHA256

    9bdbd794aa81073836e9b8903dc3dd3f3d141361ac289cbd78f0c20d9e224d74

  • SHA512

    3d7ce3b2d5ffef631fb374424dc07cbc8634a772fdbf30dfff978418b16893601d3904da0b0c03fe407232c3fe0bcbb6b29aff7370e5c45e3e7c3286b23e9018

  • SSDEEP

    384:nc6ze6e1PAhJVzC3tC1im/BsTx46PgZ0rap9HBmRvR6JZlbw8hqIusZzZJ9:le9EJLN/yRpcnu4

  Score

  10^/10

  njrathacker 8evasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  behavioral1behavioral2