Extracted

• • Target

    dfa9117334ef382d574a1524e745cb7f3445d2d9859d6222918c682275b5352cN.exe

  • Size

    72KB

  • MD5

    6c33fe602056e93e65201f4d90688e00

  • SHA1

    9260ac408501634f0b8017cd2693c42f3213fb9c

  • SHA256

    dfa9117334ef382d574a1524e745cb7f3445d2d9859d6222918c682275b5352c

  • SHA512

    90b76500963fe2bcae114c1862a57f0a038ca77b2aeac9d28f88cebf0a2e6eacc9b89f177f57b76aa2ab34b699bc5dc623f8dea354df4a0653bf44dc73678d62

  • SSDEEP

    1536:D2CPAabgGGjSBekWDbSHqtPTOt3tIUBGqqocBQN9f2xPs7a:iC42xGj7kWIqtPTOtdVBGq+g9qPs+

  Score

  10^/10

  njrathackedexecutiontrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2