Extracted

• • Target

    7bb924304ad92bca823a2552d44cb54d9c8a4a92dba535d56f715720fcc92013.exe

  • Size

    100KB

  • MD5

    1ad9fb5ac8252ec450cb4f70111fb6fe

  • SHA1

    70ac8b252e67f0363c7f64e780018a45cf7d24ed

  • SHA256

    7bb924304ad92bca823a2552d44cb54d9c8a4a92dba535d56f715720fcc92013

  • SHA512

    df40c71d839d5b1a73b047d5cad2b3b417e755554ddb8dd5b3ba634f5ea27c1ed9ed05262cde4b63516ed32a94ed1ca129dfdfdc777e4f7e80151c0c5947be19

  • SSDEEP

    1536:JMoIfhO5PNZ4BkSQB68QJRlrNw+ZnIwk0+Be4X2EWpD7oi1VO+/t6Fk:+o2GNZMI8Rl5wyIwk79/sl8Fk

  Score

  10^/10

  njratvictime2014bevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2