Extracted

• • Target

    d1ae811434293d07d0e469a872e480e0_JaffaCakes118

  • Size

    314KB

  • MD5

    d1ae811434293d07d0e469a872e480e0

  • SHA1

    eb11d34219a50255f2ca62b31ada11b0fb40396b

  • SHA256

    ad76cbd770577221adce4c8691cbad92af9e2efc1854678bdf0606c4fc86cc1e

  • SHA512

    2455b52f926ffc9f0f770c0dc171b26211091052d32e05a35e13830b0ef344d77e9ecc93760a37aee8c7ffae356f81450b4a7a5fbc2e8bd2bc5f693776e8178b

  • SSDEEP

    6144:c/3gE1sZNpXj3b1nDMwOEVBPQJiUTobhi:corpXTb1nDMwOEVBPQJFo

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2