Extracted

• • Target

    d30b2635874071bc14077678bec52a3c_JaffaCakes118

  • Size

    46KB

  • MD5

    d30b2635874071bc14077678bec52a3c

  • SHA1

    f0f87b36eee34aab8e4df6bb26f4cddb2aaadbd7

  • SHA256

    522368c63afd804c949889c0316b113d4019d720b76fec1d773a94b7eee1f94e

  • SHA512

    96ac23320acf15b7cfca1b41a954539098faa37b3fc627e5f6536518a9913b4723cc0c53b9c2b0fd3602890e8d06d332952ed7b0ab529520bb2b13862995f1eb

  • SSDEEP

    768:rMpD+Zwq3r1uFbaYh+Jnq7az+xRug+n2hpUE+fDNkQp6HwfYTpP3KoDHQPc+e4Z:rmD+HZuY5q7az+GgDbUfZkQTfApP3KoY

  Score

  10^/10

  njratb hatdiscoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2