Extracted

• • Target

    Payload.exe

  • Size

    55KB

  • MD5

    5c56be92df69c8add408d506c5532239

  • SHA1

    0dad011e6ddbd559d30217bf8b9da634a72c2023

  • SHA256

    b58ab675e6430d8d9eeb6d316a635f5eb62fb19cd1120b3d1376136df5c8a44e

  • SHA512

    85ebfc2be987a011bb4db28842a90a7be26560ee843600f0b39b0805980ba27cc00db7cd635305dfdeecb6333576c6ba501fe0f79d56f0cbe8eaa12ecc3560cf

  • SSDEEP

    1536:qPsoDnb4DNQ7SCCHDrwsNMDxXExI3pm9m:noDnEWOrHDrwsNMDxXExI3pm

  Score

  10^/10

  njratvictimdiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2