Extracted

• • Target

    74561ab8272480ac06696738092ce507_JaffaCakes118

  • Size

    93KB

  • MD5

    74561ab8272480ac06696738092ce507

  • SHA1

    5182c427adf49862dcb6d2444df487c9f1bb21da

  • SHA256

    bf65c8e2290aee1cd322f28edf25e804f9626636f0a3263281f172383b97b656

  • SHA512

    07a710a0be9869f2759bf3bcd25a0d981f9503604dd0629cad43114da0942de6fc16da34330e41d7f1c88d43565c70b66c5c4095908392b370abe266b5be7c62

  • SSDEEP

    768:tY3zGJhWXxyFcxovUKUJuROprXtgNzeYhYbmXxrjEtCdnl2pi1Rz4Rk3ysGdpvgM:IG3WhIUKcuOJQPhBjEwzGi1dDuDvgS

  Score

  10^/10

  njrathackedevasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2