Extracted

• • Target

    bc37b896fee26a5b4de7845cdd046e0200c783d4907ffa7e16da84ed6b5987dd.exe

  • Size

    27KB

  • MD5

    7bf897ca59b77ad3069c07149c35f97e

  • SHA1

    6951dc20fa1e550ec9d066fe20e5100a9946a56b

  • SHA256

    bc37b896fee26a5b4de7845cdd046e0200c783d4907ffa7e16da84ed6b5987dd

  • SHA512

    6e0725043262eec328130883b8c6a413c03fa11e766db44e6e2595dfa5d3e13d02b7a199105cad8439c66238cf2975099d40b33cdaeb4768da159060b6f35daf

  • SSDEEP

    384:rLptwff1tqGIOfIBTkqS61bPGdrNM1AQk93vmhm7UMKmIEecKdbXTzm9bVhcar6v:/pqffy3LN1A/vMHTi9bD

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2