Extracted

• • Target

    6e84440095fadd2385619f18d300b5e31cca9904f7485bc45c001d891d992e5d

  • Size

    40KB

  • MD5

    d0c18f032cb86b521a8c37ea7aed97a0

  • SHA1

    8985d7d820f493b4411641848ae4a15c210a33d8

  • SHA256

    6e84440095fadd2385619f18d300b5e31cca9904f7485bc45c001d891d992e5d

  • SHA512

    0339f8a2813d5ec6240af569375100cbda44b730a5f4ab6d179a53d8efef7134e346df6cbb67abe97417f5d49920337f2107853043e5faddc222704c20f6cde9

  • SSDEEP

    768:3QeeeSQPhpV+zPPzvkjZoVuGKhpX6dg+8TZLEfIHS4QCJZXhFNBCdBZ:heY+LzcOpNIeA1NBCjZ

  Score

  10^/10

  njrathackedtrojanmicrosoftpersistencephishing

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Detected potential entity reuse from brand microsoft.

    phishingmicrosoft

  • Suspicious use of SetThreadContext

  behavioral1behavioral2