Extracted

• • Target

    5dda1441ba55de94432b9cbfca1ab8db_JaffaCakes118

  • Size

    23KB

  • MD5

    5dda1441ba55de94432b9cbfca1ab8db

  • SHA1

    d5f9eb1c5ab1ad9ef61dc287ed27496c8059617d

  • SHA256

    329436a3e7cb66f771c413aa20a0c3436136d2df8903d6569c58ba8b8772b196

  • SHA512

    eeb109e8112f2bdbd49d6cd1a8a1bb4bf5a3bbc376101204b0929f11c349b010ae97b5adf270261466387cc97eddb6eebca2c04574e014a8dfa0cb33e91cd2bb

  • SSDEEP

    384:MslUlEvOEJ8xWwYJOMiOBZEdj1567gtwi5HhbQmRvR6JZlbw8hqIusZzZAmF:FeEvwIlLMRpcnuO

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2