Extracted

• • Target

    6dfe16f82116f1537efcac4f015247d28339062bcbaa7fc75c9486caa76a9d0d.exe

  • Size

    93KB

  • MD5

    1ed0c2e213e674c8a95694c9e19361c7

  • SHA1

    05446e3404b3171264fc344bf4013eb8ea2cf740

  • SHA256

    6dfe16f82116f1537efcac4f015247d28339062bcbaa7fc75c9486caa76a9d0d

  • SHA512

    381fd14b550674d0214d75d203264947078d874afa91122bfad5fb96c3a523fddf1dccd6c69e46c6590ca1ab9025a647e253188e7b9927f0baab8bb199c1d9c7

  • SSDEEP

    768:/Y34G/jglPPMJI08+EyrERm9hX+JlwA461mXxrjEtCdnl2pi1Rz4Rk3qsGdpYgS7:RG7gdQ8+f4mXpA4tjEwzGi1dDGDYgS

  Score

  10^/10

  njratdebildiscoveryevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2