Extracted

Extracted

• • Target

    DisableWDv1.bat

  • Size

    872B

  • MD5

    7e36cba08cf2f7556651430989871ed3

  • SHA1

    77cdb81c4081e6f3e3dd295738e6b0f128e414d9

  • SHA256

    b40994ebf386e60512bb433bd2d59505dbe20c985a04772eb6c4bf65d2511e3a

  • SHA512

    4cb8cae10769147c6e957d6c185520fd2663a87e55c1f332219cde1b877f915b29b278700d31d676276eb2d34f11aa1b1a34d5fb37cf47c8511bc00058deb924

  Score

  10^/10

  executionnjrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2