Extracted

• • Target

    https://cdn.discordapp.com/attachments/1241155149938954361/1316826199187783790/activate-windows.rar?ex=675c7577&is=675b23f7&hm=819a1d87c57a337665c84eaa15a12a319312e0f6ce1d43f1870c7f82c4125ec9&

  Score

  10^/10

  njratmpgdiscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Modifies Windows Firewall

    evasion

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1