Extracted

• • Target

    brootForce.exe

  • Size

    167KB

  • MD5

    3964190fb6503039acf4c590f1e22b6a

  • SHA1

    4201a8f44d2c449e47704ea37351589e51ee1e29

  • SHA256

    7c1978631c42844ab98a3580b131b5b279087b9ed2a955c0ff8c22f557ee900e

  • SHA512

    b1fffbb9cd0609440648542e73ed76399eef8e9c39a79bea890ca6c7d1026ebdb30fc5ce9786bff274fe659a7a482a60b514a38fc56a42165a5b8c6e0ed7664c

  • SSDEEP

    3072:e2qK4C4BoN36t4QviFC0MBn3fWl9zWaF9bPYvM9UJ8T2SXZyrgoBJtbN/3MCK2kV:eKP9zgvMx/JdSI5eb

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2