General
-
Target
090b93699964a7d2ec54b8e32f6002e9_JaffaCakes118
-
Size
43KB
-
Sample
240430-fbr5dadb4t
-
MD5
090b93699964a7d2ec54b8e32f6002e9
-
SHA1
3c314271b04a3fe9b035dce7555e463d08ee03d2
-
SHA256
2cd3af19c799225b866a3a63056c297d24313f67e2ac1145f19ac4e7fa56223a
-
SHA512
b3e0ebcf034622e351e08681761f7527fe6748e395be1c48909aa893e9b95c20ef4b9db169bbc0c08b9b566fbc5a60b20a617069c7077811e0854d3763bde77c
-
SSDEEP
384:qZy84D4olYxOoyi0I7wycuEN88FQPzgIij+ZsNO3PlpJKkkjh/TzF7pWnPtgreTn:ojouIli0gwjL8awuXQ/oqV+L
Behavioral task
behavioral1
Sample
090b93699964a7d2ec54b8e32f6002e9_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
090b93699964a7d2ec54b8e32f6002e9_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
test
127.0.0.1:5552
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Targets
-
-
Target
090b93699964a7d2ec54b8e32f6002e9_JaffaCakes118
-
Size
43KB
-
MD5
090b93699964a7d2ec54b8e32f6002e9
-
SHA1
3c314271b04a3fe9b035dce7555e463d08ee03d2
-
SHA256
2cd3af19c799225b866a3a63056c297d24313f67e2ac1145f19ac4e7fa56223a
-
SHA512
b3e0ebcf034622e351e08681761f7527fe6748e395be1c48909aa893e9b95c20ef4b9db169bbc0c08b9b566fbc5a60b20a617069c7077811e0854d3763bde77c
-
SSDEEP
384:qZy84D4olYxOoyi0I7wycuEN88FQPzgIij+ZsNO3PlpJKkkjh/TzF7pWnPtgreTn:ojouIli0gwjL8awuXQ/oqV+L
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-