Extracted

• • Target

    9c6d65bbfff20395ed33832745ac027d169cb806fc146a00c5216ea3f9227a0aN.exe

  • Size

    50KB

  • MD5

    6c95489eb651e53886d40008aee0a290

  • SHA1

    231b3186c5bf5bb838f71b448534ee7bb23e8ecf

  • SHA256

    9c6d65bbfff20395ed33832745ac027d169cb806fc146a00c5216ea3f9227a0a

  • SHA512

    b7b6c42ae3e0e4adecb212dc6acc7c2b86d17d5e1b0511c41453f172cfdd1104f5a3e02480ea0815e9aba615fc23d24357e03e751c27f891ac9e10337b9cd167

  • SSDEEP

    1536:lj9xRq1Bn0kuNLHrGs5NcBjDomH19FDLd4i1zBe:N9xRqHIFLGsf4oM19tLei19e

  Score

  10^/10

  njrathackedevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2