Extracted

• • Target

    1AF7DAEB2C2F549D0755C36956C599DA.exe

  • Size

    23KB

  • MD5

    1af7daeb2c2f549d0755c36956c599da

  • SHA1

    2081af2ec8abc78ee2f3a98dad74be4b23198d9d

  • SHA256

    a0380cdbb6ed01cf08e65c66314c034eb710ed7bdb2e2235357ecf5ed0bb6a92

  • SHA512

    f98a8f6fa3fd6d472a269f1f490f96db2b32f1714cf2f269d5fbe68c03d6b5c67ca40255059171ae87262f84f1e9dfb401bcb2d07f5ac87909ac705209ba64d8

  • SSDEEP

    384:d3gexUw/L+JrgUon5b9uSDMwT9Pfg6NgrWoBYi51mRvR6JZlbw8hqIusZzZROO:xIAKG91DP1hPRpcnuo

  Score

  10^/10

  njratminecraftevasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2