Extracted

• • Target

    mod.exe

  • Size

    93KB

  • MD5

    e9987ac76debe4d7c754f30cec95d618

  • SHA1

    7678e6011456d26f579c7dcdd238ff651cfa4edd

  • SHA256

    56510920355a5531d174cb55ebe86f4b0d85c748d0e15dd78849a29f0f3763d1

  • SHA512

    919003b30226a8cc81540f652ae51301641325516a5d9bbba140b293b3b97141fbd9274a2f1e942b75e618f57d6e02799e488b36f2cdcbc35f48cc9cc5594771

  • SSDEEP

    1536:GYqUZFRPmGvMzLsvOnjEwzGi1dDvDogS:GYRRPmGvMzIvOMi1dXR

  Score

  10^/10

  njrathackeddefense_evasiondiscoverypersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Disables Task Manager via registry modification

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2