Extracted

• • Target

    3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc.exe

  • Size

    64KB

  • MD5

    4552c7d2fcbc04b14cd616b422486c8b

  • SHA1

    b615d31bf56fa0576f422149f3df47019b39a70d

  • SHA256

    3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc

  • SHA512

    ca51b7dacd425da7723122f277aceb7435ace874ebceef4159608ce934ad5d6a19b82b7b259486e6e1068a4a3c4f54d9140b533d3a3a5fa6295de36967e1efe2

  • SSDEEP

    1536:3EFRfIIajeMzBdiGN9BbwNLi2bhtbxnCAumXG:4RfIIYnbONVv5CAFXG

  Score

  10^/10

  discoverynjrathackedtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2