Extracted

• • Target

    a8013df3e7b4242e09d9eda816623ed6f810c7f8f244a862c09d6642e4dcdb5c

  • Size

    26KB

  • MD5

    5230ab034bd4b7c980a35c06b4080b1a

  • SHA1

    a0c1db997607da4489d20380ee7b3acf03ace7c4

  • SHA256

    a8013df3e7b4242e09d9eda816623ed6f810c7f8f244a862c09d6642e4dcdb5c

  • SHA512

    e1e11609bb875d6acbb979efd64e7de69b13852e39f3f3b1d95443f2827f9a55d8476a599a1e45cf3e04f21f0ba02a55a16cc64c18392609d4265b292c6a84d9

  • SSDEEP

    384:yLjM2XwBNOaLNOFM/Av2yeCP1BBvMl7AQk93vmhm7UMKmIEecKdbXTzm9bVhcayX:sw220U0Wl7A/vMHTi9bD

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2