Extracted

• • Target

    80212787b7477e5d6c42781439c54bf42fa430337786db0dec2cb7039c0a1011.exe

  • Size

    55KB

  • MD5

    5d57fd5e4c5fd0f7ee7015f6e86ff64b

  • SHA1

    f57c2ffdba34947c804a33df0800059dc516c8b4

  • SHA256

    80212787b7477e5d6c42781439c54bf42fa430337786db0dec2cb7039c0a1011

  • SHA512

    40c4a0afae7dc9d48e54df8e27e3687bb4dbd25b9b3f6478937e6cfbc1ea54f652a5bb19a7cec509f6cf83f0397b5105d10a4becd4441f84c0b896b52a9ed39f

  • SSDEEP

    1536:SXJYUmUYaB3Ky8ibpUfR/WViL8cIbJDLtffJ:WYe5EyNbkuVioBd9ffJ

  Score

  10^/10

  njrat1discoveryexecutionpersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2