Extracted

• • Target

    2025-04-04_c10e261059dec2ce4a188f30800f1d08_black-basta_dcrat

  • Size

    18.4MB

  • MD5

    c10e261059dec2ce4a188f30800f1d08

  • SHA1

    cf07607f60b50defa6f7984bd172d1d6685f005f

  • SHA256

    693bfa070b06ffa9dd3d26cd7581ff20c78c1fea55c4530f0ee6b9763a8ec86b

  • SHA512

    1747b15b353cc7ad10a73d9e1bf681358e47447170922ab3079e49fe2f57ce9d094302b1d159829122f01b6f7329cd1a2908ff0a2de6008f75446d3f95d28e3b

  • SSDEEP

    393216:GA3mjsPL01+l+uq+Vvz1+TtIiFo0VYAj8viX219lFhSxrH+8rLBS+gZQy:GKm4j01+l+uqgvz1QtImX8vimbzcxr3h

  Score

  10^/10

  njrathackeddefense_evasionexecutionpersistenceprivilege_escalationpyinstallertrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  behavioral1