Extracted

• • Target

    e91befdf51b0ec280541185dd2de18ff51ee8761bbd8050e84c2cfbf5ed54b54

  • Size

    121KB

  • MD5

    07a3e883febcf88d078e976b831b916b

  • SHA1

    3689a29ab6681ed1af931b628ab28ef0c25bb789

  • SHA256

    e91befdf51b0ec280541185dd2de18ff51ee8761bbd8050e84c2cfbf5ed54b54

  • SHA512

    2699dca3a81496a28943be5f83a7d0bc4845e9cd332e7f802bf144095f165b3956d640b9a1f0103170fac6c636afb60506a1c3f418a90251f3980bcf7b4bfe0b

  • SSDEEP

    3072:RJ8ajpUZeZ9IBCzWWCclt1qy2qAMnhoeK1jBby6e2Cg20kvg:EApUZU9LCcH1jAQoPjBW6eF

  Score

  10^/10

  njratgoogleevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2