Extracted

Extracted

• • Target

    niggers.exe

  • Size

    14.3MB

  • MD5

    8a44ee98217bc81f0869d793eefab1f0

  • SHA1

    4756ed10cbf5dbad09746a8fa2c2e62c2f2b7200

  • SHA256

    c26e2475ef60ba969bb66c9b464b498efb1da0bf7360ff7545c1db3b707bdbed

  • SHA512

    4f18f54d791929cb24c02e8865d520e6263c096bef7ebd422578bca0600cadb6ea4b046654ef007ba056bf568ff3a19b068bf4313b4a218953a5bd2ecb0e6a02

  • SSDEEP

    393216:vOWd863huc1dQJlAwF3MnG3InVFedWm7NS/xHWgnHz:2893hr1dQ53MG4VAHsT

  Score

  10^/10

  njratta505xwormexecutionrattrojan

  • Detect Xworm Payload

  • Njrat family

    njrat

  • TA505

    Cybercrime group active since 2015, responsible for families like Dridex and Locky.

    ta505

  • Ta505 family

    ta505

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1