Extracted

• • Target

    3594215acbb1bcd736c0f2aec09b4b08_JaffaCakes118

  • Size

    175KB

  • MD5

    3594215acbb1bcd736c0f2aec09b4b08

  • SHA1

    504a12614c236f843bb60d259af963a8fd8691cf

  • SHA256

    0f2047255104025ef7b90ef43a35a5097d166a3315d15782c09cb559f67c8686

  • SHA512

    18dae9e974fdb32426d15c3932280685578a33bbe357f0818c2685bf38c3dd32af2fe7ed3a58ce588037d3c9f7422bb0d26628f564af67fa3207170570b3ef4a

  • SSDEEP

    3072:VLXKHBjmM3Qx26qzOWtfHmqRRBLmmZc7vuuPk5vKRVq2EXJj:dLM3L6hWtnvqI6vu5gGV

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2