Extracted

• • Target

    75f337fd11a946298871629af9c6c8a4_JaffaCakes118

  • Size

    304KB

  • MD5

    75f337fd11a946298871629af9c6c8a4

  • SHA1

    a8e20bfa63f8d13ff19c66cfffd323438ff63819

  • SHA256

    6da82021d8a6ed2932aab06a6826a8d732c569b35e8b27b2256c9e936e70a0a4

  • SHA512

    0a86cc9cdfce3d43156990cf65fab21e0e7e7dc5041c19579f67552ca23c098a46440258c3c4139e238eecc5c43c5bba06e0312dacf93f5a1c4dbe5d658802c2

  • SSDEEP

    3072:jKUHXBtkvDVl802DG9G32GhNvLhvvqUQO/dQVBKg3v7B20z:mUHxeVzH22GhNjhvvq3OmbDv700

  Score

  10^/10

  njratأســـــــــــــــــوانevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2