Extracted

• • Target

    9fe2bbc019db8543d35a9871df964a8c47345a19426d106894b8ef4f07f1e27e.exe

  • Size

    65KB

  • MD5

    91a3beadd3ccb440e41ee4ee7e8ed9bc

  • SHA1

    4d477640c72e12103c54900c793601c67c520c6f

  • SHA256

    9fe2bbc019db8543d35a9871df964a8c47345a19426d106894b8ef4f07f1e27e

  • SHA512

    f78c26e3598b08f79151e5605ea1b9be23154729c1c4d871d41c65450001e512474fcc294f934eee6d68e82ebc70ad14ed25b5f8c087d21d37892501f17b2f3a

  • SSDEEP

    1536:zWnyCIUoN36tXQviFw1IssUBnvAQIfLteF3nLrB9z3nQaF9bES9vMO:zWnyCIUoN36tXQviFCbRBnNIfWl9zAaB

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2