Extracted

• • Target

    8ef09a0498e51e4696d77b493deb20b33f8b17ebb02e19586aae97cd458cf5bd.exe

  • Size

    54KB

  • MD5

    2cffc41b15b6a7796cbd3a16bf127323

  • SHA1

    d7433079b25c841ab4e105bbdd57aa90da9b41b7

  • SHA256

    8ef09a0498e51e4696d77b493deb20b33f8b17ebb02e19586aae97cd458cf5bd

  • SHA512

    4bdd0e29a374fd406e9b8abe7a21900b75fd1bab189c52c4112494c69186fbda28750d7bed7281a9e484e3fb1f8e9333c7e51c993a9256cfedb6e820bcdb6607

  • SSDEEP

    768:l+NN9ZMTA3W1cGrM+rMRa8NuKVtntQvKuzkE5nwGc:lSN9u03Wa5+gRJNNySuzkqw

  Score

  10^/10

  njrathackedevasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2