Extracted

• • Target

    eaf0ce2952eeefd83801294d40c16cdaf19ef02c6cc7e75e6d1c7712506dca96N.exe

  • Size

    40KB

  • MD5

    b9dc64873f89fdd117a3d009ed7173f0

  • SHA1

    04ceb5aff8161fadbc4998e1100c02cb291e689e

  • SHA256

    eaf0ce2952eeefd83801294d40c16cdaf19ef02c6cc7e75e6d1c7712506dca96

  • SHA512

    85ff98648dd389904ae03687fa6c40a891d5156697e2fb4f351b68906c8b07c9ed141f460ee32c20a4f7e7c9e038f4ffca2c23bdb4288313c4cb65ffe55bacab

  • SSDEEP

    768:U4lD80GLtVB8TCbH9PRwxAtz/MfHiedUYOTAhe9j/9V:UuD8LtVB80FOWtz/MvRO9jf

  Score

  10^/10

  njratbyabolhbdiscoverytrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2