Extracted

• • Target

    5086e1530caa10af3e26539b10a107047f70901625962000f66373417ad3637fN.exe

  • Size

    237KB

  • MD5

    284078d25010e8a2f1bf524cf8bdae00

  • SHA1

    57d3c47af3b14bb08bcca7231257ee231e9114b1

  • SHA256

    5086e1530caa10af3e26539b10a107047f70901625962000f66373417ad3637f

  • SHA512

    3534ba34461b6d6d43b4d04cb4084fc0bc8ab4d621fe157d9ae60e0a1efbc97b7303acce88c26aaefb48a6e631055dadd0a8a328708dc04dee405d724354cf9f

  • SSDEEP

    3072:F/ItRZp06PJHbIxs+VGSYzlg+lAMSpBV4W/E+z1IQwqznHpYQ5czMWDBoWkb7RKO:zs+V7s6+l+yWD+QwqzHqQk27PJE

  Score

  10^/10

  njrathackeddefense_evasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops desktop.ini file(s)

  behavioral1behavioral2