Extracted

• • Target

    c3c5ed0fd5134db7397c1bcaff7ef000c320946298f3870b2aba97b965f76182.exe

  • Size

    132KB

  • MD5

    3f255be17cd40d77188bc994a1ae99a8

  • SHA1

    37c765ff5cd0fd5658eda7a22b38cb1ccd1d2fe4

  • SHA256

    c3c5ed0fd5134db7397c1bcaff7ef000c320946298f3870b2aba97b965f76182

  • SHA512

    6edc56141e70a192d88fda2f332c6dce7ce6dec00a0e62df341346f9bfae588eeedfa57a6110fa7c5a0b622aa425ca398c2b1459f91740e80e78196954550ba9

  • SSDEEP

    1536:zuxAI7bH0oZ2pu4dOEqXWLJuQH42iL5KNWLqlOTIr7qeZ/nCChp8t3435Yhf0OA7:o352/1qXmJLvNWLql7F9ylYYx2hh

  Score

  10^/10

  njrathackedevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2