Extracted

• • Target

    460f26dca696e74045670dee102ad0fc60705f500d5f716140e26f144da6d660.exe

  • Size

    328KB

  • MD5

    92ab6d9ac2de2b607b8d04800b71c4b2

  • SHA1

    b3bad52c795198c08c1e3f68e198450a40f4831a

  • SHA256

    460f26dca696e74045670dee102ad0fc60705f500d5f716140e26f144da6d660

  • SHA512

    fb6a845dc7ae17c557ec51f9b146a83f5c95b10ad96663eb26312b132038db5f3031d92046468deb3c4f22ce7ea989a7027416a43c87aeae6902786fab196b3f

  • SSDEEP

    6144:/bbs8miuWxBn061wjr36UIU+yoTiKVpwCbC/ry7YOTD0zJ140QKAhFUT:jgrTMn061M36RUOTvpwpNO/0Y0QKA0T

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2