Extracted

• • Target

    6f31ca947c494c4413151a81a41e936ab7edd17a6a15f08682e5595cfd90afab.exe

  • Size

    37KB

  • MD5

    0a47d55f7619dc132fe38e03be2f91ca

  • SHA1

    1038cb66aae449f5b0f9731bb0deac6f3cc3d864

  • SHA256

    6f31ca947c494c4413151a81a41e936ab7edd17a6a15f08682e5595cfd90afab

  • SHA512

    3b97c0f59d4ac6d7e840ccb106e911eb28734c558f8b0f745632c5cc1aeaf14a3892daa90981c7f66da0e13305fdbd53ef72595c53c5a18c5af7a289a86446f8

  • SSDEEP

    384:k0aIiudjtD+P3V+y0b3+LCtf1QseiXFrAF+rMRTyN/0L+EcoinblneHQM3epzX4K:TFmV10b3+LCtCViVrM+rMRa8NuWut

  Score

  10^/10

  njratmandiscoveryevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2