Extracted

• • Target

    9529683e6579dc09cc61d5f2e5909d922f2bb589586d9c2350642d525924c1c4.exe

  • Size

    654KB

  • MD5

    0f26a0b93fd42027ad725d9bcf310a38

  • SHA1

    ef07893209c2177758d444844b8220b34d995a39

  • SHA256

    9529683e6579dc09cc61d5f2e5909d922f2bb589586d9c2350642d525924c1c4

  • SHA512

    6db48257bd7559f7df1e7d7942426a3e2a9f8bd502de73a3635345df50bc6218bfda1a589195c27c40c65b51b3fd03c691947261bfea0cba56fc52585dd9ae54

  • SSDEEP

    12288:tAV6/QGTyWXV7OWvYmm9pLK/spmTyVqxXtQjNQZpc9wwjEdzwyo38GT:tLfxOWvgpryyweQZpuwwj7

  Score

  10^/10

  njrathackeddiscoveryexecutiontrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2