Extracted

• • Target

    fe0fb91a7f8da7a3809b79a9ad1ae76b6153142fc1f9690518892d891719d7be.exe

  • Size

    54KB

  • MD5

    e66def5d8a7d114550620531f5bf9202

  • SHA1

    496360134a398960bf1b999c5dd2836e206c370a

  • SHA256

    fe0fb91a7f8da7a3809b79a9ad1ae76b6153142fc1f9690518892d891719d7be

  • SHA512

    7a92375221e7c03582748bd6b6ba48c9f6f229b81ae5bc98c2fb2e136108b72d50624f70109a8f247c906702b2b094138942fe7dabadbfcbfcac7e4829086d0d

  • SSDEEP

    768:A9XnkRB2EsltqfeQ9beH3S7LJSNExWQG35bmaePD5PvG2XXJdxIEpmyg6:A9stGtqGQsHIGWWQcGDFX3xIEpmyg6

  Score

  10^/10

  njratby aflatondefense_evasiondiscoveryexecutiontrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Stops running service(s)

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2