Extracted

• • Target

    62866a7e6fea7ab746c347c7ae8f608dfd068f504c14dd20c1cc2880f718f9a4N.exe

  • Size

    131KB

  • MD5

    efb960662e44c7adae27bc3befb3abb0

  • SHA1

    39e5b584024f4767a406c97cb3d5680b0dc80953

  • SHA256

    62866a7e6fea7ab746c347c7ae8f608dfd068f504c14dd20c1cc2880f718f9a4

  • SHA512

    b3caa53496f92120f86307ff2b4a82f79a9b496cd1386fe8c283a83e9ec381232391a962cff99418410305c60e1e0bc37a9196c292dfa73fc003cfcb496fe858

  • SSDEEP

    3072:ibxSTpiG8wMZJYKR5Gevfj7rZyqEX25Ny5k1jNfLbv:ibx4ij9LjlvYX25Y5kxpf

  Score

  10^/10

  njrathackeddiscoverytrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2