Extracted

• • Target

    dc1d0319a87205834977c9193840bdbf_JaffaCakes118

  • Size

    93KB

  • MD5

    dc1d0319a87205834977c9193840bdbf

  • SHA1

    70784a051b32b34a71e73762bdd03f77186143d4

  • SHA256

    01fdfc314bfab5c7d0cf774aba4dfabc0b503b7e7d91eb1016d8b5a7fcbc83f6

  • SHA512

    efd137d0eeb1dd5c1709ab220b9f446ec76897ffdda12d884e708275751e2c5c67f7f9041bb54778307a8d0c025e8456c0bbaf3b08474e7ad27c39eb3a809dca

  • SSDEEP

    768:3Da0mkspJtyZA/vMHTi9bD5NjHmLRpbZG3bV/aPfQpFx:za0mkSbnYi9bFlUfQpf

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2