Extracted

• • Target

    CHEAT.exe

  • Size

    93KB

  • MD5

    49f3ad1aad41b40d4ff259eb6a2feb89

  • SHA1

    9b7a8d9e2b3e8e4fd30a085e50b43224f8bd10ee

  • SHA256

    7da34ade939a6a7a8d39eeca18a3ed6ad3d906f51d1ee9d65c2e3b9fce507cff

  • SHA512

    96817c7fe37886fa10a505a4833723a9f7e4da4ccd2af77ec0e65ccce7c6b688ec18ef3e6e703247269f0af4a652b0e0c098e517a62586fb256b3c9b85220ece

  • SSDEEP

    1536:0UwC+xhUa9urgOBPRNvM4jEwzGi1dDLsD/gS:0UmUa9urgObdGi1dWY

  Score

  10^/10

  njratroblecksdiscoveryevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2