Extracted

• • Target

    a36f5c12488dfafe57097a60f7d83dd9_JaffaCakes118

  • Size

    4.3MB

  • MD5

    a36f5c12488dfafe57097a60f7d83dd9

  • SHA1

    71355632ffaad43a1f7b88e4ab1c7cbd43f30b02

  • SHA256

    7a322eccb3bce396fe507ec0536e25d305bb4dc6688546452b405f06b05e8218

  • SHA512

    9b21b0e8f798488d71cbdcbbd08f1d2de6930db0b70f8f999927ee621e7a6b976a0569a96145781d06fc2d4a66b8e2d4688f71014647621187cc3278d3a18069

  • SSDEEP

    98304:qviz/27qWGq/TzuqCDl2Ptao7j/xZfx7xtBroV5m0Nt:qviq75/TzufgxZxdProVNNt

  Score

  10^/10

  njrathackedpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1