Extracted

• • Target

    57c556e9d91ab8efb7bde8ac3cb90a92f644a037809fe8bb193bfad89e84a11f

  • Size

    43KB

  • MD5

    02d8b0979cac051989fc023728655b29

  • SHA1

    482772bab0f677d64dc1f32dada47a170aac2dc7

  • SHA256

    57c556e9d91ab8efb7bde8ac3cb90a92f644a037809fe8bb193bfad89e84a11f

  • SHA512

    528bab7b98a692c119e2e3d64097452ce9bf111ceb14c43b6441a55c1ffcd1e4a98d403633a703013c4ffee0cebbd08dc970c911b570fe25e32fc757757ea57c

  • SSDEEP

    384:RZy9eXN0Vyoy77d6kr9EicEhz5uuzDgIij+ZsNO3PlpJKkkjh/TzF7pWny/greTb:DkEKgl/Qkr9/N1uXQ/o//+L

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2