Extracted

• • Target

    5a23daf9b3b5cc63cb1bc05554f08939_JaffaCakes118

  • Size

    1.6MB

  • MD5

    5a23daf9b3b5cc63cb1bc05554f08939

  • SHA1

    1c5da1257668d249397f3fc678ac922623d4740d

  • SHA256

    0435c7a496eac28db6f3af5ae859064cf133e7bda1ef44080d8a6bad1eade671

  • SHA512

    b8816d67f0ee1a1ba298314e76257f362e04fcf15cbc048a11bd98b85829f8b508f7d5cc51713c6e1f2a4eb4274995b8cee3f836dccd575af75ef92ae23bb53a

  • SSDEEP

    49152:D8iSTZdXTZdHXTZdXTZaqLd+mQb+mQ7hdDaQ7SAs:D

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2