Extracted

• • Target

    583d90996df6c2bacf096ea2f662bb576020e82019d33f75754158da8eae95f8

  • Size

    43KB

  • MD5

    fc42df7b6686f2c15ef715839e5ad116

  • SHA1

    035fe04df5483e2f820b0c69f037111008c80a38

  • SHA256

    583d90996df6c2bacf096ea2f662bb576020e82019d33f75754158da8eae95f8

  • SHA512

    afa68a9f10dc012ef10ff2dea8ac52276c4904b2c9f4686a01fe9fbb7201be6f315f44df0a0e36b50ba9c6a3901c06014c30966437487bc63928de1eecae5637

  • SSDEEP

    384:vZyAj3n1iDcsyEqtlzQAyuqEZGyeEtzcIij+ZsNO3PlpJKkkjh/TzF7pWnY/greT:RL3nU4pEqtVQAxuypuXQ/oh3+L

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2