Extracted

• • Target

    437c98416daca0a36fe22b4add8adf5f_JaffaCakes118

  • Size

    31KB

  • MD5

    437c98416daca0a36fe22b4add8adf5f

  • SHA1

    ea933e5046e0dd97eaf720d1f87fdbd27d415116

  • SHA256

    6750f669ddcdbe9f4ea006e7d0c9e79a0b8668034eb94ccf8698163597604612

  • SHA512

    47d483d31cc9b510d5085a746fff6b342519e3cc18960c8d45e06cbd32da922f2d5c3b94051c88a4a5a90ed10e6f9a844dba6ba613bde9822fbff4b209b436f4

  • SSDEEP

    768:vl8p5d5rLmzxBuJJKye8nu4LPv6PQmIDUu0tiKZj:+vKO+4j8QVk/j

  Score

  10^/10

  njratevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2