Extracted

• • Target

    6e93ed4c136f400b61c4e24df60db78ec58b51afb644ab1faffa9a956e4d5e67

  • Size

    3.2MB

  • MD5

    12e67ca3b7338ca19dc628fa6ebecead

  • SHA1

    a5874df0609b1d62fda0b92cc9764020bebe8718

  • SHA256

    6e93ed4c136f400b61c4e24df60db78ec58b51afb644ab1faffa9a956e4d5e67

  • SHA512

    2e80ec0cdb4ea19943698367140af43baeaabb1731ca072e6a404bfea2a79794b6a5f5bc478635956086dee68c1a62e51b2ff4bc56e43956108b01b6d00a0906

  • SSDEEP

    98304:Zviz/27qWGq/TzuqCDl2Ptao7jCP5uNNh:Zviq75/TzufrwNh

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1