Extracted

• • Target

    89a06a16c73f4cee629bc145fa8ca6dc2003b4c3a3ff4a0c1cec473ec42ae875.exe

  • Size

    93KB

  • MD5

    2c2a5b46bd15e13fd2f3df4c06457578

  • SHA1

    4ef3481467fc0ce0bb1df5b627d218ef2ae2fc58

  • SHA256

    89a06a16c73f4cee629bc145fa8ca6dc2003b4c3a3ff4a0c1cec473ec42ae875

  • SHA512

    1aade6ac068ee949930be301d9e9ddec20c4809e6c0463198e76ae7ba423ea1dac0b1db8195886dd9e7c33cf5d9616ab6d52c6058349cf67497192be5ba8ad8a

  • SSDEEP

    768:9Y3h+TnkpjTMpALPGMtsas88EtNXhU9Y1mxCXxrjEtCdnl2pi1Rz4Rk3WsGdpogM:y+7kVbPGHz88Eb71pjEwzGi1dDyDogS

  Score

  10^/10

  njrathackedevasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2