Extracted

• • Target

    8f713ec1e198c1f3146670988a3143c9_JaffaCakes118

  • Size

    23KB

  • MD5

    8f713ec1e198c1f3146670988a3143c9

  • SHA1

    4a1cf100216e3a677b4e06e011adf1300213286b

  • SHA256

    e9863244d1be98ec45377430e8d9f056e369677bd67649d59de9c9d1a669743f

  • SHA512

    7f451161eeb7c0c5f61d2bd82bc026811c95030a022c3fbfa884f86e00332aee2fbc82a23ca398eb57a58311a55932ab32b98460fa2b806f93699763d1e5e929

  • SSDEEP

    384:S3gexUw/L+JrgUon5b9uSDMwT9Pfg6NgrWoBYi51mRvR6JZlbw8hqIusZzZcm:EIAKG91DP1hPRpcnug

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2