Extracted

• • Target

    69a87f1faefd93c481a685a09e58fa92_JaffaCakes118

  • Size

    43KB

  • MD5

    69a87f1faefd93c481a685a09e58fa92

  • SHA1

    1e4a18d3a67d633b4aa1c59321f839eb63a98541

  • SHA256

    8e6fe5d0d927eb6fc8cadb2c68d51352a58a23783a4f9f038cf64e10114b1e27

  • SHA512

    3c6ebcaeda6cf70f7d0fe4cb948b67ac6ec4cb43acf4933093977ae622b2061c8ca57efd19ee4cdca6bfac6f02cee546b51784436e7bf967ae3674c8c3040a45

  • SSDEEP

    384:9ZyC73xdW/IUyNZ+15EFiXMoIEvbl56lpzYIij+ZsNO3PlpJKkkjh/TzF7pWnQ/l:33DxIghNZE5EFiXNHbypuXQ/oB3+L

  Score

  10^/10

  njrathackedpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2