Extracted

• • Target

    87301351de40852d96930b66553900ac_JaffaCakes118

  • Size

    648KB

  • MD5

    87301351de40852d96930b66553900ac

  • SHA1

    cf042b7fb2690e600a360adaf146873dd04c9f9a

  • SHA256

    7cdc3aac4fd2cea887b0f9f0c3ef615d470b8dbec055efebce863d7fbf67d797

  • SHA512

    616aab7bc673f804c6be6a7a7d521454c3ba895ae0bae5d4cfa5c16c080f29d13ff3315b191c86c2dea0b97462c54336c4b74f49f0ae10e72c4cfaad9f877bdf

  • SSDEEP

    12288:2eFxHPvtS8ULd+mQb+mQwWhhhhrE6zTNhhhhhJsni7lhjPyTCp9h7ukziWy9EUKt:2sJPvJULd+mQb+mQwb6hhz9ESiWy9EFt

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2