Extracted

• • Target

    72abfe56888d66111e9a6c9988a6ee82_JaffaCakes118

  • Size

    43KB

  • MD5

    72abfe56888d66111e9a6c9988a6ee82

  • SHA1

    6d7962d81e137ac1584d4d1da2238477d68e5f3f

  • SHA256

    f5f37fe430f04da2a66bd73cb8012586340df7ba3ba8021119c94a9123569c5b

  • SHA512

    8da0009c51085dbb76f3ac589c6b7e28612da9fbb0f9afeaba82e2549b8c99a910c6fe9ccd932561971ba07431da90927a9a44bdaf91aeeb65818f30c1c4ead7

  • SSDEEP

    384:AZyAj3n1iDcsyEqtlzQAyuqEZGyeEtzcIij+ZsNO3PlpJKkkjh/TzF7pWnY/greT:mL3nU4pEqtVQAxuypuXQ/oh3+L

  Score

  10^/10

  njrathackedpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2