Extracted

• • Target

    NewClient.exe

  • Size

    167KB

  • MD5

    c05d3f2f9e97414951d9a850925aae47

  • SHA1

    adf749dcdd4107fd1e9a4c235745e8dbd0c367c1

  • SHA256

    7e7889837a4f42bbc91494f39f5439ce7fc714eed949fe0c2874524fbc8122d7

  • SHA512

    04c753ee0f3155eee7db2280543e1b4309d154025ebdfddec9e5eb1943e2ef679aa4836d8c4105b81139c5ab0f8fd8d872eb2b00951998ec7b1e8dfcb4a0b212

  • SSDEEP

    3072:VcMADoN36tnQviFCtABnKfWl9zqaF9bwYvMJUJ8T2SXZyrgoBJtbN/3MCK2kevEz:V9i9z/vM1/JdSI5eb

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2