Extracted

• • Target

    694a759cd7d164d93ebc109a631ae735_JaffaCakes118

  • Size

    43KB

  • MD5

    694a759cd7d164d93ebc109a631ae735

  • SHA1

    dcb2da48c5e9a9848f00d0bd7d7ad9079ebcc9bc

  • SHA256

    e510484e9b83011f1ab83191c51fffebbb325b16daa926f649299ea5b37a3f82

  • SHA512

    f2991f414fa881fca05eadedab8a15546785af9ed1b412239d9663560eb3365ea64eeca977f44ce67aa5bdeed51674baf7fbd8831a8f104f4b4c42ccb967c8c1

  • SSDEEP

    384:RZytg5ctOnwtOyW6PRyciYE+ncOM44r2IVa9D9O5UE5QzwBlpJNakkjh/TzF7pWv:DRqAwt/W6ZyciYE+ce4r7vQO+4t+L

  Score

  10^/10

  njrathackedpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2