Extracted

• • Target

    ffcb6225c7e88893052511133926e4b9_JaffaCakes118

  • Size

    405KB

  • MD5

    ffcb6225c7e88893052511133926e4b9

  • SHA1

    ad1046228ed2d6797382440ea4ed689b0d466f1d

  • SHA256

    cf5a0b717ea5d16d8d20760a6c29561f762988f3ff5a54d6a423c0379c57ee1f

  • SHA512

    75999b2d228c4488ea0d7f988ea6aed25320b06591b60ba001075a2ee3cf36f93b7b386bb6b7890ff70b1874fd53baf2856e522a2be885aeb54031898133703a

  • SSDEEP

    6144:9pnwJiXFD2Ehc5JAOcBXnyOpnwRiXFD2Ehc5JA:bwJi1D23G1vwRi1D23

  Score

  10^/10

  njrat2018evasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2