Extracted

• • Target

    431e12f989dd7a4c9d8235f4fa9f3e026a4b55921aa2fb4942563f857681f06c.exe

  • Size

    43KB

  • MD5

    1917739297383bb37d4f159e8540b70b

  • SHA1

    12447834e3ce0745f5756f492aee4487c6c1cef4

  • SHA256

    431e12f989dd7a4c9d8235f4fa9f3e026a4b55921aa2fb4942563f857681f06c

  • SHA512

    7c8b032480dd4e9d972eceb1e1dc354ce5be2c66d777a12a45e267220e5ab601cbfc95d724379a903f59cdc39265a2e62e3d1a9fa66fbe4d8d71c0fa736489c5

  • SSDEEP

    384:HZyGdElQ5GoyyBrlr0DiEuEe83H/zIIij+ZsNO3PlpJKkkjh/TzF7pWnI/greT0k:5gmolyBr907NRuXQ/o1/+L

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2