Extracted

• • Target

    c597a3de3db7b77b11beb33640dca13812dbc26cf291856810bd170039b17183

  • Size

    27KB

  • MD5

    3eaff8ce09f497995f5be4dc1b3aa820

  • SHA1

    f2b7c3546b6f55d2c797eeb2b8ed2a37e05e16e1

  • SHA256

    c597a3de3db7b77b11beb33640dca13812dbc26cf291856810bd170039b17183

  • SHA512

    41d223f11aa428a5e262783bf732ffabb967785c7f2a7299b259f1398bb64b4a1ab3478e7e11312268fd86ee824d0f7f33c2b1b1aa5a31754c168ca4d8a26b62

  • SSDEEP

    384:tjLyib+vLGgkhRzeTwIiTSmLPeJ97MaAQk93vmhm7UMKmIEecKdbXTzm9bVhcax8:9lgKNzevO7aA/vMHTi9bDx

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2