Extracted

• • Target

    DCF20D074648CA42F102EE093E61B8A4.vbs

  • Size

    495KB

  • MD5

    dcf20d074648ca42f102ee093e61b8a4

  • SHA1

    541f17b51a863023edd6ad7d6e271bd3f1d36687

  • SHA256

    bb1605a50c8ecfeaf69f4ec3f40a7b54ed722dbb2f9286adce5e2b78d5fc85c7

  • SHA512

    415c55479cdecaeac220dd5128d44d53d7530450f32bbfaa3f9d86e8257a62078a545a0d6cc8fed38342b77d7c86775577dce7a4f79e1e2b0c68af2c1d9b9163

  • SSDEEP

    3072:KRr+dxPr+9gr+Ejr+gMSlctO+Jxq3udcXGCunzhXvek5n5p5XNsn1+7HLDVZcMxz:blACuzhXvePn+AMxzak5

  Score

  10^/10

  njratnyan cattrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2