Extracted

• • Target

    563276feb31bfe2ae44687979ce930c36dd7fb49c6d9b03e1d4ce3da8bbdc9e8N.exe

  • Size

    100KB

  • MD5

    db6cfa38032e1c194f98b7fa9ef561f0

  • SHA1

    3312632cec959450b8fd0fd19572c51ea60ed602

  • SHA256

    563276feb31bfe2ae44687979ce930c36dd7fb49c6d9b03e1d4ce3da8bbdc9e8

  • SHA512

    3952afcac094297f0b49e0753d0a5432c060352a36e17181e7f01f68ab17af7bd2bc62885416478b9966c2442b37c17b0c0ac37aa97a4b499e8fef504777f15a

  • SSDEEP

    1536:JMoIfhO5PNZ4BkSQB68QJRlrNw+ZnIwk0+Be4X2EWpD7oi1VO+/t6F:+o2GNZMI8Rl5wyIwk79/sl8F

  Score

  10^/10

  njratvictime2014bevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2