Extracted

• • Target

    2024-06-09_e668117a5357ee81c7f0ceec2f5a649a_mafia_revil

  • Size

    17.4MB

  • MD5

    e668117a5357ee81c7f0ceec2f5a649a

  • SHA1

    0854901a3ac8e9957089bedabf563aff2c49985f

  • SHA256

    8f2c6a5278c82eee18b101abae641440afecd2a8faf8cd258230131b1ffb4399

  • SHA512

    d7563c46abbc3f275bc9bc8af0def79ada4eb6e32b3cf6c2c1e20f5526b4d6f7881eac9159a86ab1b5bf4205b766de610c24731bf5dc8641081e79512ecfce9c

  • SSDEEP

    196608:ZUm7ljm0yOa7wnSvVrhWmaVKuXZdEF5pa/J1BMFov47w3HEbgBbMT:mm7Fm0yQSvVrhLaVhdEF5pa1MjbgWT

  Score

  10^/10

  njrathackedevasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2