Extracted

• • Target

    de07b53ebefb0b2f51f956664de486a9a078a6997c0508e6b9eb41d7c4c265f1.exe

  • Size

    538KB

  • MD5

    2a26d4514305fcb4bc2af3deb844b68d

  • SHA1

    68880c892211548fb691876960683fa90a4173de

  • SHA256

    de07b53ebefb0b2f51f956664de486a9a078a6997c0508e6b9eb41d7c4c265f1

  • SHA512

    8430b12fa09d691e60ebf51168e95fcd16ec750e43e293b5bf45569ceac3e665e1354e0aeb8742e59769bd9a1ca494f2f9ef83d3224d9e54d3b9ca3fb3a2eb0f

  • SSDEEP

    12288:thrO5q5qRbfdltGbr6IaRP+Tu+zLC54MV9:QqgRbdyxaRPWzLCe89

  Score

  10^/10

  njratnyan catdiscoveryexecutiontrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2