Extracted

• • Target

    041df349dc08784b924cf4c52af27a3fadf1e751f2a8f30ed9bf2ad13c7748f3.exe

  • Size

    43KB

  • MD5

    105ab4478b568f39f8e6330f54084571

  • SHA1

    5637dcae84aa5797da5490482556c61378c9f1fe

  • SHA256

    041df349dc08784b924cf4c52af27a3fadf1e751f2a8f30ed9bf2ad13c7748f3

  • SHA512

    7cac14e0709c9c749946227778e131f3e6149124803bf84d592b8c5100809b97e11140cb0410bb541a48b62b332c39df9620e7bf8224da95666d16dc266b3c24

  • SSDEEP

    384:bqZyaKVarEvEyeD0brquFENf9QFkznIij+ZsNO3PlpJKkkjh/TzF7pWnamgreT0w:ERKMYvReDwrpWfqNuXQ/ofC+Lg

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2