Extracted

• • Target

    5b7042a219a347e8a9af0c90e1f605d386a53fc48642c3a77f87cf07dadadf41

  • Size

    587KB

  • MD5

    cf7dc84ebc0ff95a60344bc727002401

  • SHA1

    359d48d84383391cd7cc2689e89da761b8bf1c71

  • SHA256

    5b7042a219a347e8a9af0c90e1f605d386a53fc48642c3a77f87cf07dadadf41

  • SHA512

    6e939bd5c800482bacf500c5a4989210df235068a98f5cdef9503d39be15bee900fbb506225964daea8eaa6c4035f37a11f487bd0a8c8a7ef3230c33d39e3ade

  • SSDEEP

    12288:TcwSDCwPsgjzeppKzBFhwE5US2LtixPA2mEQqdyy2/mVFAMEpEXuAKlL35:vgsgveipOnKP3Qkd2/MbEG8l

  Score

  10^/10

  njratdouclitrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2