Extracted

• • Target

    82cbad79dcc761c90cbdee3ea2d53307_JaffaCakes118

  • Size

    878KB

  • MD5

    82cbad79dcc761c90cbdee3ea2d53307

  • SHA1

    a5ffba7b327fbd5fb7de72f203deb8a98a82b9ee

  • SHA256

    c66c677555ebe59d5ca8f2d901816a87681bc540cc223490c0edd393b68113d6

  • SHA512

    eccb280cd34b40f9b73d0027a05827c7a35f59e3fe99a62728a58516cc84e5ac6ec30dd2c1ca028f39e8c6dae615346c0bb6847f6f7fe3cd36fd5fdbd716c0fd

  • SSDEEP

    6144:kOcPZ+zjqCCKsKLjfT123gteD30Llhdwe7W6Evwoe+wiMsvZ0F:k3B8jtrfk3gc/e7W6Evwoe+wiMsviF

  Score

  10^/10

  njrathackedevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2