Extracted

• • Target

    d6cad8bca4d08df2f14a6ea7ddca32bb_JaffaCakes118

  • Size

    47KB

  • MD5

    d6cad8bca4d08df2f14a6ea7ddca32bb

  • SHA1

    e844c24df9e4e7b0a5925d39b81d2973d2d6db9e

  • SHA256

    b254adf0d9806fddf7b32ee94064f97da988b71650a398d978cac2ea3099f516

  • SHA512

    88333789267bd85ca671b9e75b2996cf27277ae58ba74cb54c7673e75b461f99b305a14dfba2ec353f05262bc1bbfcb6e6bd47b0be44579f3ba9c3c8b4ffd90b

  • SSDEEP

    768:ApD+Zwq3r1uFbaYh+Jnq7az+xRug+n2hpUE+fDNkQp6HwfYT4XIozN2qVMK1:iD+HZuY5q7az+GgDbUfZkQTfA4X1zN22

  Score

  10^/10

  njratb hatdiscoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2