Extracted

• • Target

    af5283158b38b61c96c3e50aac904c0b202df9b651cbdadfd8dd3d55e1bde94e.exe

  • Size

    102KB

  • MD5

    24195853ff2e9a4d421d1c77cc86c5b1

  • SHA1

    c00af4632d37f2a4d5198eff0bb08f5d7478632f

  • SHA256

    af5283158b38b61c96c3e50aac904c0b202df9b651cbdadfd8dd3d55e1bde94e

  • SHA512

    dedeb06f18c6306fc069e9e722e037606aa39200c1196bff20ce894ab4b12ca70367e7f7cd66d91a9353c8844ac774965f1d676c5e0f15945a7e4c2783bc8380

  • SSDEEP

    3072:0C3MFMCcB/tldVNFa1Vt05DHlFi2h7d8vCCYvyi:0C86CcB/tldVNFax+Di2hxIdCn

  Score

  10^/10

  njratdoudaevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2