Extracted

• • Target

    6f9e818fc25378b7c29da0172e2914e3_JaffaCakes118

  • Size

    284KB

  • MD5

    6f9e818fc25378b7c29da0172e2914e3

  • SHA1

    4834094b83c26f2cfa5c105cf636036cfcb95166

  • SHA256

    cddc1b5e5c262cecf98af120d594087c32684b78feff03d92e0f1d04a19ed8d9

  • SHA512

    77f2cc5c6b1e96266d0732ce02a40bda4f865d751e833f6d1bb934de060eb5c3653e2ba8bad4405be20c3758289c6d4e87371da5ef29cdc065273e9f82f54d8b

  • SSDEEP

    6144:Z4+kQ4flIVlcU2dNXdpc2UseFxX40KTb0TXxB2GEgzuyT:K+qfD3d+vsmFTXj2GE

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2