Extracted

• • Target

    fc3e2a07c5d9951074a2808cbbc55729_JaffaCakes118

  • Size

    154KB

  • MD5

    fc3e2a07c5d9951074a2808cbbc55729

  • SHA1

    bafd6ec3da9d4942eafde39c0020cebc997c5daf

  • SHA256

    851f57aa0cd69a9eaec76d14bffaa4dc08caacb02beffb0ed1d04869d3fd1409

  • SHA512

    5c1029c0332aaedf4b87e6f6711206b995b42a6c509e9d41e0dffa69c4793b1a2a2c89a710955a11c160f30f32bcd2a4a7bfd01f4fc101033baa835c2badbd13

  • SSDEEP

    3072:ax+QMgSXupDSbLiAVydncx9vd00zyw1XXsRBYwbH26:mTSeRSX20vzyYXsh

  Score

  10^/10

  njrathackedevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  behavioral1behavioral2