Extracted

• • Target

    6e172eceb80a6f5684f2a1a144bdd4a869ab9429de0490f8ab187462e46a06b2

  • Size

    472KB

  • MD5

    830b15da953bdbf8105474e93876ac9c

  • SHA1

    2e0e49d48644c244e097c4418f1a6c801b9d7805

  • SHA256

    6e172eceb80a6f5684f2a1a144bdd4a869ab9429de0490f8ab187462e46a06b2

  • SHA512

    d7260f5f2d7985e3ca4a0783c5c9ff9c5bca8fdd64a0a47a27b9fc2d1c7cbf8bcb5e45b1542fd068dc90cf73a6967b899b53e106314ca5c964c8ad6cae97faf2

  • SSDEEP

    12288:zawtBYX/Xb9X5/yLy7n9LnX+gtV8wAeOQKNKKKKKKKKKKKKKKKKKuKKKKKeKKKK7:FtB8/Xb9X5cyRLX+UVxAeOQKNKKKKKKn

  Score

  10^/10

  njratfa9o hhhhhhhhhhhhhhhhhhghhhhhhhhhhhhhhhevasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  behavioral1behavioral2