Extracted

• • Target

    1d34e2601766e0950cbd90e75e70306b475489e31c8cc2bee00c70b887e4ae15.exe

  • Size

    93KB

  • MD5

    f7f745caed820795ba80e629ba4bbbca

  • SHA1

    3af0797e467d67dd5ffc45c8954afd468989d84b

  • SHA256

    1d34e2601766e0950cbd90e75e70306b475489e31c8cc2bee00c70b887e4ae15

  • SHA512

    b8b2cbe7a7d7ffb7f6a66972dd73c24302455d7dc7a63d11cb4cdf2980ebea0efbea32343a3167b9f727f86a4fee6188fc71f427a21665978bfec8fbcb6907dd

  • SSDEEP

    1536:s4UpR8lZc+/2HK1j+fTd5jEwzGi1dDWD5gS4:s4UpKc+/2HK1oTdWi1dQ2p

  Score

  10^/10

  njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2