Extracted

• • Target

    QuanTV Installer Graphics.exe

  • Size

    178KB

  • MD5

    74b087c43ad5dff7d519878b25326ced

  • SHA1

    4f517f471ed6a65bf53c3cb4498c4e0d51c0ae7b

  • SHA256

    0d237244a7f008094c4aceb20d24d34549f6e3781451efa79c2bdb0351836777

  • SHA512

    045592b98d656aa91dc1d4fb7d8f2393c2c3d06be14700b6fc7ce46e04ffa21d73b88c36a9e0d9ab17ea987c6124ad8281b01eef7aa01c345553c87221424114

  • SSDEEP

    1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbgcV8w9ftsQuXQQao:XVqoCl/YgjxEufVU0TbTyDDalXeayh3J

  Score

  10^/10

  njratquantvfivemdefense_evasiondiscoverypersistencetrojan

  • Modifies visiblity of hidden/system files in Explorer

    defense_evasion

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2