Extracted

• • Target
    cbfa2e4458747eecb05c8813a94700b2.exe
  • Size 691KB
  • SHA256 bf8b455cc351263446a8a1afc1f2461d2cbcfca273aaa6be24c22afacd6f281a
  • MD5 cbfa2e4458747eecb05c8813a94700b2
  • SHA1 77ace1902d0fb55a916fd825a24bd4bfa2527cf4
  • SHA512 0465c70a4d9409bcfc10f397e3086d96164aac6b777fbb63d9e67b939e22f253e6a3ea11c9323cc3c7a895b0b1bed4d6df3450bae2e47459664aa896ba205c9e
  • MD5 SHA1 SHA512

  Score

  10^/10

  njrathackedevasionsuricatatrojanupx

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2