Extracted

• • Target

    c89ae02ef3579cc9f123f9bae9776050_JaffaCakes118

  • Size

    43KB

  • MD5

    c89ae02ef3579cc9f123f9bae9776050

  • SHA1

    f37365f7bc653881b4b0ffdf1dfe8ff28561b272

  • SHA256

    627e2b8e17e1d011b6fe60469bfa1eaaf9ae754dfbc0d02aa977b60938136d82

  • SHA512

    ad9c6bd6ad8d80270cf401727aba85d6ecc76f144db5bc83a0f3b7a7591c65cc19113ad709ff2d8beb3f208e30331c3cd10abb961ecd03f96247afc2d0787e2e

  • SSDEEP

    384:qZyqlll4Ruoyvv75V7eAy8uECPEfPY/zAIij+ZsNO3PlpJKkkjh/TzF7pWnf/gre:oZlOIlvv75N3D0cMuXQ/oq/+L

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2