Extracted

• • Target

    fb26c4493185a4e3e342ba64039230d3_JaffaCakes118

  • Size

    123KB

  • MD5

    fb26c4493185a4e3e342ba64039230d3

  • SHA1

    f3038344bd098aa68cac92b93b31e78252dcb9bb

  • SHA256

    61e71dbee8ede60f76667430bd9d716da701f4a136f972976c756ee899889d95

  • SHA512

    c1c08cfd5398ed109634a236b0325897e671bbba83a4b4a34a764baf192f84a6726271701496522aabeca639d5bd55d2cbd3c4e2a0f1b42798c04be335d31782

  • SSDEEP

    1536:7hYHzqSA2gPf9OIiIotpCbKF2FNtvu4uw:GHzqSA2gPf9OIiIotpCbKF2FNtvu4uw

  Score

  10^/10

  njratfevereiro2019evasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2