Extracted

• • Target

    c8d3c048a92b468514343ac258e5c8047ea66ef3b54e4f4200f7243de06ae31fN

  • Size

    37KB

  • MD5

    0e78a49bf12394a06cf511f72d76c040

  • SHA1

    6bac7cc2f03a22654151501a02570b41a9db4365

  • SHA256

    c8d3c048a92b468514343ac258e5c8047ea66ef3b54e4f4200f7243de06ae31f

  • SHA512

    f5a5797326eae328f3876889c1e4f07d7fb853df6dd1a06545696c2fcc59ae1a9fc1b28f1c4a3b1f592016c31ac20c0704531d8d68b8208040f2b1aef1c0e962

  • SSDEEP

    384:ckaIiudjtD+P3V+y0b3+LCtf1QseiXFrAF+rMRTyN/0L+EcoinblneHQM3epzXV2:fFmV10b3+LCtCViVrM+rMRa8Nuzyt

  Score

  10^/10

  njratmandiscoveryevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2