Extracted

• • Target

    6bff62f418c98855248ac7e0c87bbd892a7ad17aa03676804196daf31dd04f6d.exe

  • Size

    30KB

  • MD5

    19de48e4e81f875006c35199f29f0f11

  • SHA1

    9c49296219e43eb7ee1cbe278b3eb57939b15b59

  • SHA256

    6bff62f418c98855248ac7e0c87bbd892a7ad17aa03676804196daf31dd04f6d

  • SHA512

    57555951d496e1e8fbd9e6ae0f7b76630a2d61d665ce19da1a89c330d4cc3fea7bbd9f91f88e38eb93e62a6b11f221844873f6d0af751f940fff9aecad487a7b

  • SSDEEP

    768:ZWN1SPXImFO2n8dPiXVBTX6Cjs2x3i7jMCP8/qg/vE1M:ZW7jmFZ8dPkfTK5286/qg/v2M

  Score

  10^/10

  njrathackedevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2