Extracted

• • Target

    75af76d2a53d30d3d005ed79719b0839_JaffaCakes118

  • Size

    23KB

  • MD5

    75af76d2a53d30d3d005ed79719b0839

  • SHA1

    e811f724203ec37b0ac9906349db186a190540ba

  • SHA256

    e58d01ecd88c6acb84893e0a4ecbc823cc3715770d22e1e761f9c5ec9b44d5b1

  • SHA512

    d512cbbe97f7a1bb6bd7744192e7b845d89544ef008cd241d22b4f69ebc9be8796388efe49a96d7d203fc994f8af8ece63f2664560a357f943db74e611c177a7

  • SSDEEP

    384:yluBPiZCMfdfSJrQbsLRGSIxYVL46pg/i8BD9BmRvR6JZlbw8hqIusZzZLm:lOmhtIiRpcnuh

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2