Extracted

• • Target

    7e5cdb1f90f0fe63a1ae0ae850d61da4e56ae23d53041fd9e14002761ffb4e2e

  • Size

    649KB

  • MD5

    d5cfb8356001e1ea478e2f66648f132b

  • SHA1

    5d4b419bbd52f0ac2f682b46fefffed6e7621b48

  • SHA256

    7e5cdb1f90f0fe63a1ae0ae850d61da4e56ae23d53041fd9e14002761ffb4e2e

  • SHA512

    9f02f9086f3f88914b9062fa41f225b32721d528f6036ce5430ec2225a51ba2ce596c98a51a2b85fcb261c196ac42e0c2a3f8c57a6254c264ee7cd9cc4477abf

  • SSDEEP

    6144:TGxP9WE3Ow/2pVNqVotvLDkivApjJRVg+U/+vNl0MAyigSNiRU9/kXkxioatQ9U3:CxIExJiynfUerAyDQCkxjIfBWMt

  Score

  10^/10

  njrathackerevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2