Extracted

• • Target

    36c8bb2585ecb14b32a35a62bdb32895515328a9f4768dc4876bad3c9f0666bcN.exe

  • Size

    43KB

  • MD5

    b1283fbe4ed44ab1d1933fb2976a1aa0

  • SHA1

    c344656fd10baa86224e3da852ffd37293a8882b

  • SHA256

    36c8bb2585ecb14b32a35a62bdb32895515328a9f4768dc4876bad3c9f0666bc

  • SHA512

    4d5972c134d7b148509a7ff6e27edd118377e9647b47ca569fb8244b79fde441b0d3bdd645fd804d1e1fccf3ef4f16658becbf1a29719fc3182283332faeafa5

  • SSDEEP

    384:bqZyaKVarEvEyeD0brquFENf9QFkznIij+ZsNO3PlpJKkkjh/TzF7pWnamgreT0k:ERKMYvReDwrpWfqNuXQ/ofC+L

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2