Extracted

• • Target

    21a041665739c2c913f293f0d8085e0d_JaffaCakes118

  • Size

    6.9MB

  • MD5

    21a041665739c2c913f293f0d8085e0d

  • SHA1

    bfc0dcdab5efeb5cfc6ea38f2f7ad40a3e5e8d4e

  • SHA256

    16dd470cb509378fa66178d54a2376f26c204a8d7742eeacd746106aa8fb43a2

  • SHA512

    6b0e104e2f3826bf9300866a02b7249f2ed0cc111f76f8c786f84be8af7b647257e7ac542babfecbb6d8a702ae779d74821bcdf39db26b67622a77ce302d6100

  • SSDEEP

    196608:mezqgNY2R7H8FCp3u1685Gkip0hyL0HV:mez/W2tcoN0guI0H

  Score

  10^/10

  njrat??????discoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1