Extracted

• • Target

    ba5fae13322d5151dfb348ac1a2abc92d021617c154ef9d1e4efc70bf7fdf03bN.exe

  • Size

    749KB

  • MD5

    9a9e86899eb8f8279dfb72133be528e0

  • SHA1

    e6d233b3382830ab3b8d130ff296be2bf7de72e3

  • SHA256

    ba5fae13322d5151dfb348ac1a2abc92d021617c154ef9d1e4efc70bf7fdf03b

  • SHA512

    6947b28b67edf868c644c1f5f527efe107169ceaa383e2236feb486914651def57bc92b9c525d025a665a84307df81e70b5f102e3d85a9c1fd33a1e7fc563f0e

  • SSDEEP

    12288:bcsCELA+12Hd5lpvS36pDfi/xN3xb2GzmtVzxWWx0GKl/yCQwEyC+oHRf4kzGhkR:5zmrzxWjGKl/WhOoxw0

  Score

  10^/10

  njrathackeddiscoveryexecutiontrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2