Extracted

• • Target

    1102b76e764dbb7e3978258f47eeaaee10429ba18de626d116913056185c35e4

  • Size

    23KB

  • MD5

    21dab2d70a43dc5b058f6e711f4c8526

  • SHA1

    0b6080334661692c432eb36a0a4e19b240d6b936

  • SHA256

    1102b76e764dbb7e3978258f47eeaaee10429ba18de626d116913056185c35e4

  • SHA512

    fb597f271298d6b8eb89969db7d6c8d5891f049525cf219eca96bb6f45e817bf9350bf5307d59b61092d4463818c99ceccec3ae4f14247fbd2c1431980b10317

  • SSDEEP

    384:PzRWKCWs5Mx/YZPxvnjmQdFxH84GlQ6rgdAyZxLdmRvR6JZlbw8hqIusZzZNpa:PtmXAOvnjDdF9cRpcnud

  Score

  10^/10

  njratbetabothereevasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  behavioral1behavioral2