Extracted

• • Target

    70c3d829bdae416936ca9d91f3af0377_JaffaCakes118

  • Size

    123KB

  • MD5

    70c3d829bdae416936ca9d91f3af0377

  • SHA1

    ead7d66cfdfc2107b6f066c8d847f6329e575eaa

  • SHA256

    03966a81834fb029ed4539180f98f9d69942f0858edc0034994944a0ca5836ed

  • SHA512

    8449dd8b097f429b5cd25b0dde808f1ff521b8eac85746c45406c06bf0cddfcc7c5ab2bacc76064af44663ee6d6492245b053d5609233c71de14059e8c064c18

  • SSDEEP

    768:jCBNRrJkz1jeEbsnhuo5pHEWJGTTMHVMwNTR/E7EfffX71P1z1:jCBzCz1jPqh9Ht1

  Score

  10^/10

  njratbobaoevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2