Extracted

• • Target

    sqlmap GUI v.2.0.exe

  • Size

    2.6MB

  • MD5

    74965febb08e87910b0f9d29eced3ff5

  • SHA1

    3228699546d63437dc845a5bb1d63f86591fa91e

  • SHA256

    ee1fd2fda74829875c8c27d05b4e6296459988d19549f30e4ed3ecb513bd2f43

  • SHA512

    9c316c01101e0601b363f85d7ba42fc488af4aa2ee107100ff6b0efd70e1179910594edc735a3aad2964f518c741bd188bf17736cc07c90914526222fb00e869

  • SSDEEP

    49152:eibqIZcBH4W4FyCBEmS35w6OBcVQh2scABeMkOV0cu68:1bqIM2BEZ5w6GcpSxRV0a8

  Score

  10^/10

  njrathackeddefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  behavioral1behavioral2