Extracted

Extracted

• • Target

    22c54abbde95e1f240a8a65343e6faa9.exe

  • Size

    31KB

  • MD5

    22c54abbde95e1f240a8a65343e6faa9

  • SHA1

    8f6727a8ea3977e1f5fbea78c1390d6cc8a1b36a

  • SHA256

    ccaa9f9e4a61111b9814917dcb9703768743dffc8faec938bc480c7b091c33dc

  • SHA512

    86ab53c341cc671e6b8d57bcb12a1f4337e6d36f5586480ec4a90234d73780626020582ea72c9a381392d0f54d6fa9a0f03b0f3d83b32c97c227899e9f40e171

  • SSDEEP

    768:8J8R5d5rLmzxBuJRSae8H5LPvyQQmIDUu0tiroj:DvKmpj3QVktj

  Score

  10^/10

  njratxwormmpgdiscoveryevasionpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Njrat family

    njrat

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2