Extracted

• • Target

    d7bc1429e88074976cd64b913ebcd7b0cc52f766059a6a0604dfad9004f4de8f.exe

  • Size

    291KB

  • MD5

    b553abb412ba34bc311058ee33cfc397

  • SHA1

    b0ecb499719c915c2ce9e1941edcaa24362f6225

  • SHA256

    d7bc1429e88074976cd64b913ebcd7b0cc52f766059a6a0604dfad9004f4de8f

  • SHA512

    b31b57b9adf272f547b59e96ab4339516a3c2e0d141233e39b98745904012a975171b2e80e2b9c0e5eeaa9adb7cd2e1790ec3bb54fbe5f6afdc6bdd58691a784

  • SSDEEP

    6144:P95EeRw+PquKUEgwanRpFWM+moPk2sT5kbd0bQ:l5zRw+PqubvwanzFD28T40bQ

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2