Extracted

• • Target

    d93b561a58ce89091771f20881fa1d24_JaffaCakes118

  • Size

    43KB

  • MD5

    d93b561a58ce89091771f20881fa1d24

  • SHA1

    3f081cbc52eaf6fc48a4464f25f3546442413199

  • SHA256

    78667d5efedf8c141ba5f8391c7f674d29e9ee92ee849a6a4ab37dd5b8a12f98

  • SHA512

    b41461a5ad2943ef79ea32c34b6168eb090c2272421e234eeee939aaa8e8698905db8e99cfbd2ed9d71a2a5d23c7af9cee80d9d9f049aa7060209fab420fa86a

  • SSDEEP

    384:mHZyussV6LkcyG5KyaxVOIEHpAha0pf/pUzkIij+ZsNO3PlpJKkkjh/TzF7pWnFh:m5htsYZGsyaLO/pYjf/ouXQ/ocU8+L

  Score

  10^/10

  njrat???? 10 ??? ?????? discoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2