Extracted

• • Target

    1.exe

  • Size

    55KB

  • MD5

    ac8733a16862797fe27d86a080a46cce

  • SHA1

    4884cd013329a1b434f2ec8906223ef96b89d00c

  • SHA256

    585de753d93fcfd637af3d7c9814bd9dd42f733d3167a25f420bed3f075cf0f7

  • SHA512

    a142f852fcb4cc7067738e71df8e286060888142cc2924f006c2a9e8d154998c6f171a94ba89355847641375307d0562087e486819defb679ecb2b0fe533671c

  • SSDEEP

    768:ZVbHFOt1MankGn2NsW6ingB3wkkSNOmwFvfu0YMDHPsAL7XJSxI3pmwm:ZVZcDn4NsRinqtDDwsNMD3XExI3pmwm

  Score

  10^/10

  njratvictimdiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2