Extracted

• • Target

    93565d5d87b2e249cdb56e98176f672dc83cbeac64755c7029b871ca1909eb01N

  • Size

    191KB

  • MD5

    10a4bd0c82aba827cf4f082eaf3b54e0

  • SHA1

    3c80f9379afa871175a02645c4e790d0f6579b62

  • SHA256

    93565d5d87b2e249cdb56e98176f672dc83cbeac64755c7029b871ca1909eb01

  • SHA512

    258de9b796409d7f7cea3b3e2eb63805a5e772bc0f7bfd240b181657dacae4eefe00a091040514b380d6b16e1486757732b803beac745aedac5f4bae5f661c15

  • SSDEEP

    3072:NntBsa2y5YZvArE74+ssm1XGejfRJGTJlnR0JI++2IS4BmkUo45fpZ2+:Ntell3m1XGejfRg/V+NhkUo4RpZ2

  Score

  10^/10

  njrat ضحيةevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2