Extracted

• • Target

    3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe

  • Size

    524KB

  • MD5

    43fbab667475e2717bbfa907ac2b6786

  • SHA1

    8d5af9836a8713aeed86424189d2cdb8b4318a8d

  • SHA256

    3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061

  • SHA512

    620ed0f8bbe926d4cce8474f4f70e29011bbcef2e3f7be74a6590d134a34f2781f478c4283626f9b53d8cf9054ae3ac83b1ff4d3ccdd67b94c6c24d43f79c474

  • SSDEEP

    12288:irOj+Ri3AgFdNfsuqW8BDSkiqD7hWw+OwZkT:UQ3AgFsuqBXDPj

  Score

  10^/10

  njrathackeddiscoveryexecutiontrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2