Extracted

• • Target

    abdd5a9c8d0ebce3064c11608b96b99194ff9d0e53322fcd557f35f832c3d76e

  • Size

    23KB

  • MD5

    174dbc902fdc8d1b3cf8473015aeae85

  • SHA1

    e99d3c3cc51c5987d0f5e1d12d156d0247c1ffec

  • SHA256

    abdd5a9c8d0ebce3064c11608b96b99194ff9d0e53322fcd557f35f832c3d76e

  • SHA512

    880f7ad0c6ba91dd4cb100f3b03653d09193f126c8f78b6d7e051611ef04cbd5d2cd0b5006b172dfcef2e3dd4150c41daf707634e1fbbfdfed40737c3258813c

  • SSDEEP

    384:2LQeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZnf:2s5yBVd7RpcnuQ

  Score

  10^/10

  njrathackedevasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  behavioral1behavioral2