Extracted

• • Target

    ed9d5228f09a3b6ab41654ae4535e13b_JaffaCakes118

  • Size

    507KB

  • MD5

    ed9d5228f09a3b6ab41654ae4535e13b

  • SHA1

    39d26043d0e2cba9b3ec9fbfe0cc920a3bb45665

  • SHA256

    98b0708f87e441e6ab181053cf6808ebc7671134624feb047222a9324a9f7847

  • SHA512

    f93e7e2dc089b771079ab91667976ab14e42d07bab0468fa0b59d7d701cee85d615284e10549538ebd1cdf38c9c8555cd81d4688affd62ac4aa92cb570c53f48

  • SSDEEP

    1536:AeZN1s3o5pMCgNlWnkEU2jKIUBL4DZ8/F/n1dO:Auvp5KNlc1jKTL4Z8/Jn1

  Score

  10^/10

  njratlastevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2