Extracted

• • Target

    c87001299a6b8f5e31816b5fe5689f77_JaffaCakes118

  • Size

    43KB

  • MD5

    c87001299a6b8f5e31816b5fe5689f77

  • SHA1

    0f9dd0039bd8e59f153b9fee598f97eb21e0677c

  • SHA256

    1788872a46f28d6e1593df23c4502bc5834b9f41f9e544b74848aea6913939ba

  • SHA512

    bcbd0f94f17f60a9ab894077f23afe165a423abcc046e6edcc58860b8fbe01b47f221749a6af630abdab06443388986667639075e724ace7f82a627078ee97ba

  • SSDEEP

    384:2Zy0KNUst+3gUy6L7nCCCE8b9JszQIij+ZsNO3PlpJKkkjh/TzF7pWnL0greT0pe:s8wQh6PnlWbuuXQ/oCQ+L

  Score

  10^/10

  njratdolbaeb@discoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2