Extracted

• • Target

    69eede8d58d95ddb8c081d88e6bd795e.exe

  • Size

    1.5MB

  • MD5

    69eede8d58d95ddb8c081d88e6bd795e

  • SHA1

    afaba911b01704e5bd2f7100143fb45c4d11a48a

  • SHA256

    2395de00a23d65cb4eb0805b96fb8f326f5045413b0d19185727e302b0133bcf

  • SHA512

    34ea399a06a26ccd96a46daa45fad419acb51a02fe2e8154dc1b816378c3f5abb2a730ac66131857d53e575d7d49db95664a91c1ec246e8861db35ab05f1fb40

  • SSDEEP

    24576:NLllLl72qXJMqgzokSg5gOvCXZnx6dmZQSe4mLe+npOebr9UnJpE02+VrMnA5OR9:VllLXX8zxS8vC9xMmZXZCoemJgaHUu3E

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2