Extracted

Extracted

• • Target

    fd5a04863bebd358a2b8bbef047fa0f5_JaffaCakes118

  • Size

    650KB

  • MD5

    fd5a04863bebd358a2b8bbef047fa0f5

  • SHA1

    e6e6fab141e3ee22b304f47e07509a9173273098

  • SHA256

    32fa254b0cf9a2b8d7090b09390b8788f7bf8d8eebce813a98295e521d19ec01

  • SHA512

    279eaeb7d009cf87d322dcc6f9fd2ca18f41d36a073e3a6b99bc71a2a32a8517741f900653ba645bdf070f9cc7fad3ea0f9079ddf78c5429a7544f6efc61c8e8

  • SSDEEP

    1536:Dsq+QV4rObAdXWpf/y+YapVAB3Zfcpn+1MVoyJPkbu1OK1OvR6EPOsmHfEXXknC4:O44rj/law5GfqPc5GfqPaii08Twm8gg

  Score

  10^/10

  njratxtremeratserigrafiadiscoveryevasionpersistenceprivilege_escalationratspywaretrojan

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2