Extracted

• • Target

    868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe

  • Size

    180KB

  • MD5

    4f333b5a74e464d8fd46fe49bedc760e

  • SHA1

    110588bfa2559e700564af03db5cf851be5ac3d3

  • SHA256

    868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d

  • SHA512

    5ea9dbfae7dcf16f38aa0b064dd51cb7f6d398d5bb38b0877e9c7bf6b676151c01828c030d9d2f03707366651a66a3df39985aea43528baea55e79e83f784baf

  • SSDEEP

    3072:AK3fycY2pTpIb42etB/RpH5pXZOaXqmmgDXnkUrsK0GEx4FvPA+LjpgKab8iPt9G:9r9GE7PH3XZ84kUuVxG7Hpg3f9dO+

  Score

  10^/10

  njrathackedpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2