Extracted

• • Target

    0a5fe6735794d87d1cb917aa4b92947f571eff6b5541008cc1f76a666df4fbfb

  • Size

    65KB

  • MD5

    915756ae44759560e8476467163b0f5d

  • SHA1

    02c6eeb6a68c4fab801061321645c3cf118b823a

  • SHA256

    0a5fe6735794d87d1cb917aa4b92947f571eff6b5541008cc1f76a666df4fbfb

  • SHA512

    4d7b862f7e4dd4856eac8e5982eb7ed10afddb943661b84cd8f06293fed80e26a65595a89b6abdd1d99bd6154791169006a6d0a4f572de756a691cfb9889049c

  • SSDEEP

    1536:bukC8Q3PoN36tJQviFw1noU5BnvA7fLteF3nLrB9z3n+aF9buS9vM:bukC8Q3PoN36tJQviFCocBnIfWl9zOa+

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2