Extracted

Extracted

• • Target

    RuntimeBroker.exe

  • Size

    200KB

  • MD5

    7d856cab9faf146bd64db6e3b4250945

  • SHA1

    7c301d07ccfffcb70c6a367d6285689640bbadd9

  • SHA256

    226933448c3c854b320702c200cbea27ba19aa1d44d013e0749555398b8f6fc8

  • SHA512

    c737008f532026363cffc8417674c44291db1f62866ba44417479ba5c68f20616511cdf68f4ffab81f87d43a9c9b4ea78db36586355cd4aa928c81b95a416784

  • SSDEEP

    3072:g2L1i3qsMybTZ/SSjWK17WQvEatSVreypTaLrFiGdn076YI/rx:g2LA3JTd/BF17WWVSVSyltGd0mr

  Score

  10^/10

  njratxwormruntimebroker.exedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Njrat family

    njrat

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2