Extracted

• • Target

    448C39E12BBE57810E98D6628625B536.exe

  • Size

    509KB

  • MD5

    448c39e12bbe57810e98d6628625b536

  • SHA1

    30d35d936577e137738f96bea180cf966d19964d

  • SHA256

    83d1fdd6869066e5137c1e6143a643be25ef6339a4e4ef470ffe7678d75d4dbf

  • SHA512

    463ecd73d9e2ad0088f8e12c111b77f9b6642e22184dfc87269b21c70fb68400072745d0c21d9ddfb4df82b30aea6941b3674f3dc4cf9a389399a7b4160e470f

  • SSDEEP

    12288:FmsKpkF55OHTDPnDlJmzd4vYHD1s54xhn+KyGvXK06etO:FBFXOPDlJs2vYH+Y2GvXNF

  Score

  10^/10

  njratskypediscoveryexecutiontrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2