Extracted

• • Target

    cb1cd0093d25a4e8b25dfbbbca80ac7a_JaffaCakes118

  • Size

    631KB

  • MD5

    cb1cd0093d25a4e8b25dfbbbca80ac7a

  • SHA1

    1d0fe0367be370c2b63d3d3d785f2a49d6f093f1

  • SHA256

    a8c5577f91289348ad9e7350e2a9d351f0c6629d93ebe35580a193f0a9ee76ec

  • SHA512

    97caec63273ac128bf067aa013670c97e7dd7845971e9d3079ded3fd91b1acb0cea4868eb9414a652f908ac7cecedda008560539cc6c23a7788de4627c5b2293

  • SSDEEP

    1536:4lK/D257wieHPzOEPn5oozoFK8oGKbsYBvaBBqhETKdNwiB7aTPF1njY31TrFows:md

  Score

  10^/10

  njratnyan catdiscoveryexecutiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2