Extracted

• • Target

    63ea07828dc4a630118822a995ba76bc25e66539fbe897c3b12a53df8c74b590.exe

  • Size

    749KB

  • MD5

    764342f536b37eb0afd7deb9ecd2ae75

  • SHA1

    f0e4687a52f433ee41344017eb97cea58ba54e53

  • SHA256

    63ea07828dc4a630118822a995ba76bc25e66539fbe897c3b12a53df8c74b590

  • SHA512

    97e541f8de4bf7434c6fef0addee2526bea24e2c9f43494115e55b01a7805f42ef76a471ef7458f5a851441c519afc678971dbf1b6f4ad7cf26796890fbde288

  • SSDEEP

    12288:bcsCELA+12Hd5lpvS36pDfi/xN3xb2GzmtVzxWWx0GKl/yCQwEyC+oHRf4kzGhkh:5zmrzxWjGKl/WhOoxw0

  Score

  10^/10

  njrathackeddiscoveryexecutiontrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2