Extracted

• • Target

    a375df952b34f757d9b4315b18ff5de0768e3ee4b788530db7855e263fdc93f6N.exe

  • Size

    102KB

  • MD5

    cc1cf6f32f8923208e5fd9aec0132c30

  • SHA1

    47e161e2986e28a52ac2c92f184198a38016e838

  • SHA256

    a375df952b34f757d9b4315b18ff5de0768e3ee4b788530db7855e263fdc93f6

  • SHA512

    4e1b8bdf308d39f8c4453b898af568faf00b727e585a39ee9bfafeaeaf7b383285cc3c0a1bd8ff6350976c8eb93263e3ef65e89c8fa8f5ae3cb7a71eed0e441c

  • SSDEEP

    3072:0C3MFMCcB/tldVNFa1Vt05DHlFi2h7d8vCCYvy:0C86CcB/tldVNFax+Di2hxIdC

  Score

  10^/10

  njratdoudaevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2