Extracted

• • Target

    ServerConnector.exe

  • Size

    43KB

  • MD5

    0e2c6065af1bea6f94768961125a0a3f

  • SHA1

    938403124a9f3efd78c773c4e43a986a404de3d0

  • SHA256

    e43e506f857646bd35bb45d8893e7278e05835290c69549b2c24fbc5b5d8156c

  • SHA512

    52c1e9b2d4e63697bdfc95ea8899ecea10bbf3136c80d130993179ce16eadb0ad87c7d5dd9bed4c7cdcf87748cdd639fca2b8804e932710eb56a955e4f4ecd15

  • SSDEEP

    384:GZyL55ctOnwtOyW6tDyciWEc/7eqE44r2IBzgIij+ZsNO3PlpJKkkjh/TzF7pWnU:cWqAwt/W6FyciWEczei4r9uXQ/oD3+L

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1