Extracted

• • Target

    obligaciones_pendientes_sec_mov_2023276515707015200336545221455855_pdf.vbs

  • Size

    332KB

  • MD5

    2a28e419f1c07d440fcf6779cc78b9b8

  • SHA1

    a6681a295d708c684f74e1fb5c15501601eb2c4e

  • SHA256

    2013f46026e284a93c81270b13fb80fc20c5af43e89dffa744d6343f4623cd7e

  • SHA512

    c940d2c9511b252f1b1feb3ffa62d52a6ea3dff64952e2cd360f5e31b6dcc493c3a015940e540915280c35409db5dad708af35b066207696d921a79c96a1bc40

  • SSDEEP

    1536:j89r/aDcWJwG0mtvR/Eg5KvjVPxu9PkaKEpigImEMYvW3L:Kt4L

  Score

  10^/10

  njratnyan cattrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2