Extracted

• • Target

    0b772f76147e7b238d14de0355cef5e90726574f9fa313675f687a7c4913d222

  • Size

    93KB

  • MD5

    fcf64d897dc4dd3e3e49f23236a90f78

  • SHA1

    3ed20b44d33fbd84c3daa329d8a711841100fcc6

  • SHA256

    0b772f76147e7b238d14de0355cef5e90726574f9fa313675f687a7c4913d222

  • SHA512

    000c7112fff71f40b6e336e4c9d538a621f355d48103d5463727845b26db9324e773952ea5b68afa84cc52032a1b05303906939a21e27ae767c98e8603ddcb37

  • SSDEEP

    768:oY305yD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3vsGO:k5IOx6baIa9RZj00ljEwzGi1dDbD4gS

  Score

  10^/10

  njrathackedevasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2