Extracted

• • Target

    Everything.exe

  • Size

    106KB

  • MD5

    060317250cfe7e96901acc7c27a84bc7

  • SHA1

    0e85789e56309e5832dc7d2be081bd4193373ee7

  • SHA256

    d55ef4b76f8250026b20d9c61eb191f9078ff75b846f0d26b29b01c02cd24d35

  • SHA512

    7bbba13add3f69f5a18db2cb9df91725be607bc019c507a2e8feb4e6b45375261dae761682bcb481e5b2cb8e5a245e67c77318c1ff2654df6b7d82dc0532d27a

  • SSDEEP

    3072:s/I6viVfIHn9P4mF9bXKh8/s+oLIYXeWYs:s/IJIH9Pt080oYXe

  Score

  10^/10

  njratwindowsdiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2