Extracted

• • Target

    winX32.exe

  • Size

    27KB

  • MD5

    eee37f6f66eafa13d9555dfc9ccb3805

  • SHA1

    c9b2dd6b4bd464cb767b5ff1260dc07e223cd0b8

  • SHA256

    ca569ad2e113c57c5ddeb1770ae4d63f579df3504306097ff8a16b1cb37dcaa9

  • SHA512

    9bf9709f3a1dcdf97d7c88e133702f0c46756125b65adc7b6b3d61ed7b624aa5212729f7fe95c35ef1d457175c3613b4deaf625268c9651e8bdd57201c379218

  • SSDEEP

    384:fL1M2XwBNOaLNOFE/Av2yeCP1BBvMl7AQk93vmhm7UMKmIEecKdbXTzm9bVhcaM4:Te220M0Wl7A/vMHTi9bD

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2