Extracted

• • Target

    a25673d120384ef69c9e5837d8d04995_JaffaCakes118

  • Size

    398KB

  • MD5

    a25673d120384ef69c9e5837d8d04995

  • SHA1

    8f33b1fdad76d0d75fa9dd47c1cc938662950b81

  • SHA256

    dcd9736647b75c8840d97a840ccd5d7074aaa38f48a640b15c5172378cce3825

  • SHA512

    58b0fd3dbd3167c586ba66d885acefae4394ea7cc2bedd9dbccca76688e75038de00f450c91e62d3fc33afa58cf992b694fb4bda3a9d803afab852c10d5fabaf

  • SSDEEP

    1536:3vZfWsbvJP/LoZ8WIfk3qprPJ1owCU1M9wtLtt/:fVWsjRjg3qpzFo

  Score

  10^/10

  njrathackedevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2