Extracted

• • Target

    0d936f1998c4af40879e795549e5ff68682c7d9b884fb0cc0c135c30348292d3.exe

  • Size

    72KB

  • MD5

    f52133dd61f5a0001aa4a89809894a17

  • SHA1

    9099ce1cbd442ba584cb06a87ef9bec77abbf093

  • SHA256

    0d936f1998c4af40879e795549e5ff68682c7d9b884fb0cc0c135c30348292d3

  • SHA512

    8dbe8e41e8fd6057cc72ba69263b3f35690eadb88b6c3f94fbaa9789d40920be7e2e2cb3d4ef5a7c18a820e7f272472067869ff34495a30b32c301834349a32c

  • SSDEEP

    1536:D2CPAabgGGjSBekWDbSHqtPTOt3tIUBGqqocBQN9f2xPs7aW:iC42xGj7kWIqtPTOtdVBGq+g9qPs+W

  Score

  10^/10

  njrathackedexecutiontrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2