Extracted

• • Target

    de9fa2fe4f0be05dbc0089d148a8f666_JaffaCakes118

  • Size

    43KB

  • MD5

    de9fa2fe4f0be05dbc0089d148a8f666

  • SHA1

    d1519b0150e92f3a0791b5b47aad76c1552cf241

  • SHA256

    555cd583a20def5bacd0f90aa29718cc7937d08811bc0558eb1739040928847b

  • SHA512

    cef5dc2ccac0b4140aee14f456c147f7f1208b15724ac67e2f30cbf3aa99a4609ec45f2b009425f639472f3ae19e19137ebfcab684c02d4857df9ab33065d662

  • SSDEEP

    384:V8ZyWQF3VarE8yTTTfqtiWqEnkDai0+TzEIij+ZsNO3PlpJKkkjh/TzF7pWnmrgm:V69i3MY5TffqtpSDluXQ/ofL+L

  Score

  10^/10

  njratuserdiscoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2