Extracted

• • Target

    11d49dd9407654efd37f016694461dfc.exe

  • Size

    93KB

  • MD5

    11d49dd9407654efd37f016694461dfc

  • SHA1

    55f385dde7de9eb303a6ad158a6150d1322da736

  • SHA256

    a77d89af9f2b35acf31f220c08293373fb7670ae463d114dd9aa0ba76d040d96

  • SHA512

    2c27613c62c759059c17758cc62cada5d08e5fc0382d3c4a64badb85c45301cdc4fe38f87da328e6b98adeb00980d0b503e790b0616ad514ffb5f9d324af58c9

  • SSDEEP

    768:PY3IcRhpC0EoQspgnOmWNW6tsX2JADll2gSXxrjEtCdnl2pi1Rz4Rk3wsGdp/gS7:9cHpVEoKOmWM6sdl4jEwzGi1dDID/gS

  Score

  10^/10

  njrat2.tcp.eu.ngrok.ioevasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2