Extracted

• • Target

    hx.exe

  • Size

    93KB

  • MD5

    57d650f467affa363faf1c21b652f7ab

  • SHA1

    7b051eae98e89004b7ffdbcd77fc026467f0da95

  • SHA256

    47eaafebdeb6b9be421fd70676f8939885851a1e4bbc278b210c0c0b4ae95ba8

  • SHA512

    b3a171f1fef417a0f18e09f18f16b394c761bf9dc76e8520a6639195bc3eeebcb15ca99e9981df2918938ed4c379b4300b5665eaa14f47dee1ca08dd14fd0dec

  • SSDEEP

    768:XY3flByZnDQMMpAZrGSt6udttXymsahkGJiXxrjEtCdnl2pi1Rz4Rk3jsGdp3gS7:+lUZD3rGWNd7DhkhjEwzGi1dDvD3gS

  Score

  10^/10

  njrathackedevasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2