Extracted

• • Target

    3ce4f1864d97c5a67c5e7cc2b95bbb41c04f543b87a79e536d8cc967f230f5efN.exe

  • Size

    158KB

  • MD5

    23a40c967d707eade5cfe85155482ed0

  • SHA1

    031f1da1325b3a766825d5b0fa6d6f8861a17887

  • SHA256

    3ce4f1864d97c5a67c5e7cc2b95bbb41c04f543b87a79e536d8cc967f230f5ef

  • SHA512

    37f33673d920a1b170e34c7ae9e1d50a7a1ad59ad1e34f5dd6b7b0e70ba543c8b9c5e101554a2ac9b08e1ebc392ef7a415178e17449ceaf522a8966619fce92a

  • SSDEEP

    1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXKXcwFtRWuqk:UVqoCl/YgjxEufVU0TbTyDDalRucwb0c

  Score

  10^/10

  njrathackeddiscoverytrojanevasionpersistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2