Extracted

• • Target

    600cf1518ec06857b75a95d56638faf79e41e7c9d4d8561dce5cf8fa2a7f8999N.exe

  • Size

    30KB

  • MD5

    d7fa71fa3dd283c8bb3d4c6ac76d7bf0

  • SHA1

    c98bf34843bd2d450ef77b7349816d54f363b16a

  • SHA256

    600cf1518ec06857b75a95d56638faf79e41e7c9d4d8561dce5cf8fa2a7f8999

  • SHA512

    053f90ceb30595f0cf074bcff9e395b21ea0470ab769f9e54ccd038719f9077b7dcc93c5b3d5326a2bccca4e019e8ce1c553748282d342fc9f94685acf3957b3

  • SSDEEP

    768:ZWN1SPXImFO2n8dPiXVBTX6Cjs2x3i7jMCP8/qg/vE1:ZW7jmFZ8dPkfTK5286/qg/v2

  Score

  10^/10

  njrathackedevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2