Extracted

• • Target

    39e8ba6f38d52bb24f88ebcbfbca1789535664226b71dfaae2e3571c5aea08c0.exe

  • Size

    75KB

  • MD5

    22ce647526270fdbd18e1e4e603482f3

  • SHA1

    1564549571731bbae399933b8e5d59525bd44ffd

  • SHA256

    39e8ba6f38d52bb24f88ebcbfbca1789535664226b71dfaae2e3571c5aea08c0

  • SHA512

    24c8e1b7031dacc87abcfb8cc16f2fd8e1ef3b86661e4200b87fb395db1d797babbd4163a09d2507f00baf81f0ad188d3c153361136853b840bc75912fa9cfe0

  • SSDEEP

    1536:zd/KqwpacXtNYjonQekfnBTIVXFyeOkTMO8hzGXZ5ZF:zdrEBdNYjo/kiVgk4ThSHZF

  Score

  10^/10

  njratتــــــــــــــــلغيم الســـــــــــــــــــــــــevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  behavioral1behavioral2