Extracted

• • Target

    SilverBulletPro.exe

  • Size

    1.1MB

  • MD5

    1719753c2e9deea9520d879a5b8d01b5

  • SHA1

    50610f754a2b99017eecb449eea4b0489d1cbdec

  • SHA256

    de36b984b5c5a2716d8a4b8a32dbdecddc41b379374159f66862567130da88d4

  • SHA512

    a91199c5ba5c4e9dbdf9fea12b228c5f5650f5b53b09481fd937be44d3d6b6fce3f0671af46e32923dacacbbe0877ced61251995a38d183da946446685b9c5eb

  • SSDEEP

    12288:pAu6wZePi/hIRMJuAfkiaU7vsBqpq+S1SwW8o3sovW3Xrvk9I6ULshS:iwZ96M0/iaU7vqqppvcbvsULsh

  Score

  10^/10

  njrathackeddefense_evasionexecutionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  behavioral1