Extracted

Extracted

• • Target

    sa.exe

  • Size

    223KB

  • MD5

    84968f988f3fb7eecb1087187d8d4508

  • SHA1

    fa662dfa9ce6edea74bc94596d2079581cc71adf

  • SHA256

    04258bc5802a62bc686aa877e6944f9ab613eafffcb3b00e66db8eb46265d63d

  • SHA512

    9f6a207b3255d53d0b3ee80c933c250926dd36ae4ea03bfb290ea72e6a4033aab75c457073c7a2d46aabbf28347231fa202355f686d6dd4b4f7dd37fb1dbf1af

  • SSDEEP

    6144:16pFBtjbnNc/dqg1ZCuU9B8fMkCMglsgQH:c3nsd5rDS0fg+gG

  Score

  10^/10

  njratxwormbyabolhbrattrojan

  • Detect Xworm Payload

  • Njrat family

    njrat

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2