Extracted

Extracted

• • Target

    NOTIFICACION_DEMANDA#171220241132000000.vbs

  • Size

    4.4MB

  • MD5

    9e4789f5e93baddfbb0a0d9d995179d0

  • SHA1

    6428dce88b1ff117f406ee0b5b3e438f86572f04

  • SHA256

    072fff870e4f1ac444693546de130e7f690085074c30486d067a027da603b700

  • SHA512

    212b8cfdd8b14e8252080bb287c23c360ccaf546b5040d51c5b1573a88df61aa1c4092d850a370d623c648a68661431289c1bddaf6c42a37ceea3d01ab759edc

  • SSDEEP

    384:glklUlklUlklUlklUlklUlklUlklUlklUlklUlklUlklUlklUlklUlklUlklUlkR:1bCOMw

  Score

  10^/10

  executionnjratnyan catdiscoverytrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2