Extracted

• • Target

    Sigmanly_b37508a2880228db684f461822c955304158e1e4bf210ebb4892466d81d5941c

  • Size

    27KB

  • MD5

    2c4fe940c0aaf722b86f2784c09b65a7

  • SHA1

    6260d732f353cff21ec5f131295f169cf07f111e

  • SHA256

    b37508a2880228db684f461822c955304158e1e4bf210ebb4892466d81d5941c

  • SHA512

    b15b40035bffea1e285874817a302cbeeecfe1adebabab5ee978c8194175bf74aeba5c35474e0217cbfd1f8dd5ef25e9a3ea64ba51b1732be07db13b30296f3f

  • SSDEEP

    384:mL9QKJ3buZjmgERA4MDwoyumGPiJRjMFAQk93vmhm7UMKmIEecKdbXTzm9bVhca6:AaK5buQE4MfLFA/vMHTi9bD

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2