Extracted

• • Target

    aa48ccdfa1745229e582ae602e9f3a79_JaffaCakes118

  • Size

    23KB

  • MD5

    aa48ccdfa1745229e582ae602e9f3a79

  • SHA1

    1136c5daf000d3a65156ae418682f75ab63eb1a0

  • SHA256

    18fa0a208116287b92ee73d26fcef335312ca45effefac24ca80fbc07eb86b97

  • SHA512

    8a01910c0f2573bd16d7109dfd72ac7476aa94e744fbdbf6fef0a14ed48ea5f7f2e3dc0d021af2ad8f9e7509a657a7fea556100e0dc23936927e3b142e2e5475

  • SSDEEP

    384:kEQ+SAN7uprgvM5OSUswZXg69gbm4hfpFmRvR6JZlbw8hqIusZzZCU:qOaxVULRpcnuY

  Score

  10^/10

  njrathackedevasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2