Extracted

• • Target

    fb7e05bd695c402fdb62f4ec07d5d697_JaffaCakes118

  • Size

    43KB

  • MD5

    fb7e05bd695c402fdb62f4ec07d5d697

  • SHA1

    3d20523c4b79e14c6a08f6dbeb931d4c0e5582f8

  • SHA256

    d88306c00686f6d35899a1cc07a65e7df6b6e1ad2e9c33ed36a5fa7acb508250

  • SHA512

    a20895bacd921580dbbc455e33ff4ce819c421970e0aebce4696c468a69998b0274c1d239b9d4cd002f02102fbc11df45cf9f8bdd649a2e151ca503ad66437fa

  • SSDEEP

    384:TZytNVxdW/IUyNZEX5QFi9WW2Ezb156lpzYIij+ZsNO3PlpJKkkjh/TzF7pWnPtl:dQzxIghNZs5QFi9lZbipuXQ/oed+L

  Score

  10^/10

  njratcheatdiscoverytrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2