Extracted

• • Target

    e1e8e0d2bf75e17a16e67f6464465bda_JaffaCakes118

  • Size

    926KB

  • MD5

    e1e8e0d2bf75e17a16e67f6464465bda

  • SHA1

    e04ed93dfd3609d854ade621945cd9b04c39b983

  • SHA256

    291314516707e7419f4788ef54dea6af38d460a8ddcdf30471654ec44e948ae2

  • SHA512

    cc4b939c82420f4f3bc0d28fddbf8f07aa01704e17498311c067d5e179404669aac88414dbe7f580151208619464d3660dd6781c7ce3186769e2b96c00234c09

  • SSDEEP

    24576:SS4xwcRDuQel/EPRoAFtH6Rle8Q5cOTano:Sxx9DuQnyAFMnscOu

  Score

  10^/10

  njratclowndiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2