Extracted

• • Target

    fb92d98b147af3b765c213d1b42e6204_JaffaCakes118

  • Size

    25KB

  • MD5

    fb92d98b147af3b765c213d1b42e6204

  • SHA1

    d7e56084f1093b866324a5b8afd54881e1bac787

  • SHA256

    f90a864e9f30cd099f8e467ab39f6adadfcfa926a8c181603f3360e470512eb5

  • SHA512

    aea8b826d9fd984c4dbfbd27c009847fcf7e27784e8730ca2b561e64e68a05d20b38299064ceb99a705dc2ad42f6e882b56ba4a2a543ae94a29b713f3e917668

  • SSDEEP

    384:sv3ZIr+2Zsz3IVjucbU4K9Wu8Yu8jeljFT5rIjku0/yfFLlvb/wc69fhQZ8T:svpvrD/B45LQe75obthD4raZe

  Score

  10^/10

  njrathackedpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2