Extracted

• • Target

    dcbb32405ee05f65b14eeeb946736623.exe

  • Size

    37KB

  • MD5

    dcbb32405ee05f65b14eeeb946736623

  • SHA1

    cc73493e9d5cd12d9e1c96e22c5581a293bf83bf

  • SHA256

    d29c210fb38115e7dbab2db78822979b2227a2cdf9809be230bb1af40125b2e3

  • SHA512

    d1c4d752a2d3e486eb1a11090cc11e9f54b457c535d51514ef8fbcfbc914d421c6811b47741669e5cba5dff02fc3c4cd2e6209d91732e3087008a75bf4cf4dad

  • SSDEEP

    384:b6bZpj6icjri5Z7JAyk/A4wfL3Ze6Yd2rAF+rMRTyN/0L+EcoinblneHQM3epzXq:ubXHJ7k/A4wzZrYYrM+rMRa8NuhOt

  Score

  10^/10

  njratwelmoroffevasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2