Extracted

• • Target

    3b293d74827ff906a5ca3a4e4439e98f_JaffaCakes118

  • Size

    188KB

  • MD5

    3b293d74827ff906a5ca3a4e4439e98f

  • SHA1

    76d14a79e2be1543ab79873e7b87f0deee8aad17

  • SHA256

    3f330d95bd8bf7c71809189a1aa5285fea9d63fc7d193cda4b827e04bfa16bb3

  • SHA512

    255295a70314398b0b96d4408f0606d385773accd0d5811cb697ff4f80b58c15f600ef9f18e17b09edfab9879541e6104fc759343cd36e1ed609899598a62d8a

  • SSDEEP

    3072:GJOgUyL6Msee8JZo34CTmlXbvMnSIRLMH8eOtWejCOGXeAYgFwnHBKLg209BY:GFXO8JZi4CTmlXbUn3FuODCRXeUwKG6

  Score

  10^/10

  njrat|erica|discoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2