Extracted

• • Target

    66a1743f5791c9746a988bb1e5c250f25941a3122430be24380d9a9cb3484961

  • Size

    489KB

  • MD5

    3dbe30b615ca39afbc28c4e00fb5941d

  • SHA1

    199f664cf6d92a172c2e2d8cbfcd71f2884f2906

  • SHA256

    66a1743f5791c9746a988bb1e5c250f25941a3122430be24380d9a9cb3484961

  • SHA512

    2fd60508dfbe0942363bdd1183df0e2c43d628af036462d9ab648bce15209ef39061e64b162174b500fb5c79a3dcb07a6098bb365c9eea76dcd4fb0ab62110e8

  • SSDEEP

    12288:tar1ua/gY5dCTiJ5njy4NR/9M4OZp75vl07sOxc:ohn5QyNykI4AVly7

  Score

  10^/10

  njratvip@dump evasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2