Extracted

• • Target

    8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4

  • Size

    27KB

  • MD5

    47bea8a28b1e81e3342d594fc57acd8e

  • SHA1

    d301e8985e53b7baabf9b45df087a017e3817742

  • SHA256

    8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4

  • SHA512

    d5f2bfa425fa0c8d7fe2531b57ed9dbe5ca9b8bb8b7a868e39b251182446a22bcf01c3181d17b3362bc2a76b56cda1e504db2436fafbf922ee2120f76e8d00b6

  • SSDEEP

    384:2LBH6uj/+AU9038hfOexuaP39hRnMYAQk93vmhm7UMKmIEecKdbXTzm9bVhcaL62:wBa0mkspJtyYA/vMHTi9bD

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2