Extracted

• • Target

    6127a5b69321d528be5b48bc4bed13cd_JaffaCakes118

  • Size

    31KB

  • MD5

    6127a5b69321d528be5b48bc4bed13cd

  • SHA1

    6e783d6c4e5d45778bde23f49f4de28dc8ea7d3e

  • SHA256

    e5a8ef56ab277f7173011dd5c065c8000f86481c55a6c6ba58fea623d090f3b6

  • SHA512

    dbc43d5225509c894339bb99035a0476da0084a14c6357a905bd5de03cb33783a74caae3e8aac722d5ac3e49f2082fe04653cd6c9dbbc255836b0e83525b45e8

  • SSDEEP

    768:l52Q/AJ5r9mzxBu9SrK/aBPvUN+QmIDUu0tiCHhj:3/0s9RJQVk5Bj

  Score

  10^/10

  njratminecraftserverbruteforceevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2