Extracted

• • Target

    12b6c4aca8af6a0bf15e9278d47a66ef8c7f2772e4b5e863e6bb64289dd47837

  • Size

    120KB

  • MD5

    9e35ed09d72c4f30704f9a595755846e

  • SHA1

    ae793f91198f294e045d3ebae172a3e49153613d

  • SHA256

    12b6c4aca8af6a0bf15e9278d47a66ef8c7f2772e4b5e863e6bb64289dd47837

  • SHA512

    a62d55cd6d124ead3136b938af63d5eaa97d9eccc2a184357523d29eb1e5405346192d5541d419a6fe6842d9ef721a11d3da981c46608ada382ddd02c09fd502

  • SSDEEP

    3072:3Jki7jvtWHvqueH+08lWwftVLWYTwKeItbgQQ4w4qEV:ainvtCSxolWqLt0Kjbc4DqE

  Score

  10^/10

  discoverynjrathackedtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2