Extracted

• • Target

    eade534945eceadfc259a4757b04eea8_JaffaCakes118

  • Size

    123KB

  • MD5

    eade534945eceadfc259a4757b04eea8

  • SHA1

    4ae86826b1e4550b606de12adefc782f95af67ea

  • SHA256

    ded328da0fb7e26887ca2c85e342223b9c7c5eae47959601c7dc0a3dc314938b

  • SHA512

    88cb1717f4cf1ce722593acb90b0ef9bc3193e56fa22439120b97d497e794ac1079676b79cf359d021de684ad43acf808261c3541aeaea0ca0ebe667ce2b3a90

  • SSDEEP

    3072:WJiw5lLprlEymSEix9HLEN8P2rV8XDc8:WJiALbEy7XEN8P2rwc8

  Score

  10^/10

  njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojanupx

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2