Extracted

• • Target

    f747150ab61965f0a0d5bfca6c190795733eb46671a3dd500073f51c2457075b.exe

  • Size

    432KB

  • MD5

    57a9c69d63266d547a59f374abe187ea

  • SHA1

    c3f628d6fa93a1c89c1adb7e9ca9c913395de44a

  • SHA256

    f747150ab61965f0a0d5bfca6c190795733eb46671a3dd500073f51c2457075b

  • SHA512

    d971f3f0a1c9e003d3c32b937a84cf9f0f8b50df0946b4c342df5682f009a5bffab318e3edb66f5e0bb2fd0436f9d0fb88b0813206007c04c63b8ddc3c7fb943

  • SSDEEP

    96:fsDYb94x6pIEYaXcwhx5zWLYxT9FS7Z0epAIb+zNtp:UEb94x8pYapz1WLOxU7Z0dcYv

  Score

  10^/10

  njrat2021evasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2