Extracted

• • Target

    e17d019f39e42adfecd6ae98ff6f99c7_JaffaCakes118

  • Size

    168KB

  • MD5

    e17d019f39e42adfecd6ae98ff6f99c7

  • SHA1

    316119a476c9c10c0aa7ac347eeba40fa3a9ce79

  • SHA256

    72788c659f7186370af95bed8037137ccaa982649707a4a34fde81ba24c66384

  • SHA512

    56bfda25c6025237625024e72029f58223f304fbb619580e7d41d2862d8f58955b64af47e77fbbdc7fe68ef381c96916bfde7a967dcb0668098565fc70ade753

  • SSDEEP

    3072:lvGygixsiq1I5GWp1icKAArDZz4N9GhbkrNEkee3i5aiPw2IyCxxt:HvTp0yN90QEVtMyU

  Score

  10^/10

  njrathackeddiscoveryexecutionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1