Extracted

• • Target

    ff7c120fbef25763588b82d27ffa2c3ac04dca2665f6f5d5e3aa0911b7a29012.exe

  • Size

    29KB

  • MD5

    387066fa34cff110387fdef8dd7851f6

  • SHA1

    c88610c2ae895a36a720947c300282b2b5559b4f

  • SHA256

    ff7c120fbef25763588b82d27ffa2c3ac04dca2665f6f5d5e3aa0911b7a29012

  • SHA512

    0b7c4b53ab0aa0ab26acafa85dad1a51853eb3cb1d949e07662126857d69b390d0141a87009f68356fd9bc1dc69de6823a8385b9f0555a92311849f585ad6265

  • SSDEEP

    384:ZSItl77FDFucYfKQCcHN5vljmOmqDIlXHeHNGBsbh0w4wlAokw9OhgOL1vYRGOZD:v77ucYfKQTtzjAqc3eUBKh0p29SgR+Y

  Score

  10^/10

  njrathackedevasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2