Extracted

• • Target

    Daxon.exe

  • Size

    228KB

  • MD5

    770e16a5bfc519bbeb406858ad8416be

  • SHA1

    6adcfd39d8c6d7446597a2e1ea0fd6a549187fe8

  • SHA256

    6f133792af0d3db042dcefea44d4976c3132791c86f2d84db4545fd56f17893e

  • SHA512

    fdf0bae050c9a655e67e0e013e30ffe095dae3ead9cad9ac2f545b8f17c2441e68b02008e102b41f4ce281d4ef77445b896325d823ce3b2403c04c9d641deb0e

  • SSDEEP

    3072:XtSUpBVpd2JE7Y8E/UJAP8rxLLnEHBAnpK37nXM8b0e+Q7RKPsR74tyJTN+KXB2E:4cVAE7YH/UJkmLD8B5KPC9BI9xAa

  Score

  10^/10

  njrathacked by daxonevasionexecutionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2behavioral3behavioral4behavioral5