Extracted

• • Target

    a872bfa41308674ce755d580307481089287f32c0da127b3e0334044361273dd.exe

  • Size

    93KB

  • MD5

    a113e36d190813b3f6cc19ea636f3e4e

  • SHA1

    93654319bd00ffee5969bcadfdab3322212fc536

  • SHA256

    a872bfa41308674ce755d580307481089287f32c0da127b3e0334044361273dd

  • SHA512

    0a97ea0ac853cb53fae9012d25fcf2f894ec9f1e0b18dc3a6a3a58325fdae1b03250b48998366e6dc0d1aa200f981c9d2587a8e913ca29f35fb5668e3b6069ce

  • SSDEEP

    1536:XFJGER1tMnnwlOU5oTRKwjEwzGi1dDsKngSb:XFJMnnwlOUWT0hi1dzgO

  Score

  10^/10

  njratdockdiscoveryevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2