Extracted

• • Target

    JaffaCakes118_ed06232e5df3c0577632fdb2ceec8ced1facee18773d73dd1cc228ff00371442

  • Size

    93KB

  • MD5

    b411c09b425438604412a414b225c03e

  • SHA1

    22eaa702485c0303ff3bde8b74588f22fc541cd3

  • SHA256

    ed06232e5df3c0577632fdb2ceec8ced1facee18773d73dd1cc228ff00371442

  • SHA512

    adf8c3cd870ee87ef28f4f71b781536240a4493b4ec80da6a5fd2ca06e863e71733142cc6d010c798fb738211f4b3224253d5e00946e251d58dd11367bb9566b

  • SSDEEP

    1536:HCOs5p8k2HGjTpZ5HoTjEwzGi1dD6DegS:HCSk2HGjtZ5IYi1dkD

  Score

  10^/10

  njratdiscoveryevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2