Extracted

• • Target

    f6a7d13a0c660ef95ce260345d6292e9_JaffaCakes118

  • Size

    43KB

  • MD5

    f6a7d13a0c660ef95ce260345d6292e9

  • SHA1

    7759242eeb650e30062beae2d07c044489339355

  • SHA256

    087701ce73bee509cf6e3da1a85898914b4a30e17e73aebf344d413f42d74894

  • SHA512

    37066b32e7d0c6b0038ae3fb33aad84127560028b6783a69f88490f37ab563ea3fa4d95a5fed889c2a86af4c779f3792099b0cf4b5f7297ffe98dd40a40a65fc

  • SSDEEP

    384:ZZyRCFIB+oyiFN7cWMEHavIuZzQIij+ZsNO3PlpJKkkjh/TzF7pWnLfgreT0pqf7:7n+Ilir7zOHuXQ/omf+L

  Score

  10^/10

  njratmaximdiscoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2