Extracted

• • Target

    e101b5373089ee47b3c267f2d346de65_JaffaCakes118

  • Size

    635KB

  • MD5

    e101b5373089ee47b3c267f2d346de65

  • SHA1

    f74216e5973d16303781ae7ecb605b628648a95b

  • SHA256

    da19464234b78daa22a5e87253eb150827e4216bc10d5bd2393ceb9984cbf539

  • SHA512

    bfa825c1fb2bdce4eca3bf825d7aab27780a8f2ade3352ec864f2eed7c861f297db6886f232ab677df1cfa31d964383344fbdb1bc29013979642b3b86cc90a4e

  • SSDEEP

    12288:q5dFxHPvtS8ULd+mQb+mQwWhhhhrE6zTNhhhhhJsni7lhjPyTCIPNekH9h7ukzi8:q1JPvJULd+mQb+mQwb6hhe19ESiWy9E5

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2