Extracted

• • Target

    9032963d4238d2e00a795579141d263a_JaffaCakes118

  • Size

    43KB

  • MD5

    9032963d4238d2e00a795579141d263a

  • SHA1

    0039ef6abbed0f187c88512a192e97ea83e572d6

  • SHA256

    a04628d5c6c97eec5c31aa85706b40e171038c118f27fedf7aa093bad43cc363

  • SHA512

    ee4070a029e75ceb5c5ae942808726ed7cb04051085537ce33b4265b00dfca2a1c9093022324270aea8df4400615158cc150b83e6d91e0a787aaa03355fd6157

  • SSDEEP

    384:2ZyxzE1STss7yKSDzGS+qE1rpS2dzsIij+ZsNO3PlpJKkkjh/TzF7pWnO/greT0k:suok4smKSPGhrrkYuXQ/oP3+L

  Score

  10^/10

  njrathackedpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2