Extracted

• • Target

    6a96925275796e33e2ff9587da78ad0c_JaffaCakes118

  • Size

    23KB

  • MD5

    6a96925275796e33e2ff9587da78ad0c

  • SHA1

    8778d3d8ae2357f54de8bd789f5fc1b7b31492d1

  • SHA256

    c71796c63d7efa5ccedbf93d50a492c1d91d395a8fa89975ef2c2260f9a03560

  • SHA512

    8c0890dfeca5e73dc7a9c679f594a7892c09f708a242da2e4a7f5067f21a11cb24c9e69f4da55a605fa2fde9aa2e84b6da881a97559eaaf87949566a8266d3fc

  • SSDEEP

    384:ac6CqbFYh3odrVCGiHssDB4b6i6fgpEupNXRmRvR6JZlbw8hqIusZzZHG:dIU0tw3RpcnuR

  Score

  10^/10

  njrathhhhhhhhhhhhhhhhevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2