Extracted

• • Target

    e31b56ca4bf0ba57e5bf00b5e508d66b_JaffaCakes118

  • Size

    55KB

  • MD5

    e31b56ca4bf0ba57e5bf00b5e508d66b

  • SHA1

    3b4f7390aa6fc57d93e84ae5a8efd9ce8ad39bd1

  • SHA256

    868445ea9b47fac6a13bef896bc29ebd2818b4db5d7f039f5642f605cfaf1ad2

  • SHA512

    7524a38b317657a694f36eac688a20ff8836ed136a81607eed546d8c2374c4fe92fff3550c1285cb655f6988fb20580c2b2c010770b4df35b97b9bc97828ee64

  • SSDEEP

    1536:5QbBT6oIhZqvGE1S8AF7vvi7l+hGu+qgGNRcQ:agCHAF7vvi7l+Gu+qgGNeQ

  Score

  10^/10

  njratbeerevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2