Extracted

• • Target

    6da1b9e34be8401e656dd8a263d1857a_JaffaCakes118

  • Size

    23KB

  • MD5

    6da1b9e34be8401e656dd8a263d1857a

  • SHA1

    c252431527c0aebb9edca387ce9ddb71d2baa311

  • SHA256

    3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1

  • SHA512

    48b3dfbd194b4f9cd74236cbe4f67d40b844590d3a355a491a4b1e2220a5e1d86f856569a2ca87219fb5a76233a28d66d8bf889e90b70c6c058908630d786e79

  • SSDEEP

    384:qToWtkEwn65rgjAsGipk55D16xgXakhbZD0mRvR6JZlbw8hqIusZzZMEC:qM7O89p2rRpcnu3X

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2