Overview

overview

10

Static

static

10

JaffaCakes...bc.exe

windows7-x64

10

JaffaCakes...bc.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc

  • Size

    165KB

  • Sample

    241230-g9we5a1kfv

  • MD5

    dfdec291a53f62834e81d192af2fb64e

  • SHA1

    959f8ffa233dd320b100258724adfe69b71144a5

  • SHA256

    5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc

  • SHA512

    e7560f6a230f37f18faf4876aae015e3e0050f0ea6f09a637e53cb559abbd020ec48e8e971f055641ecf8057e928493e1469ef56b1bfeede533bad48c95e23d9

  • SSDEEP

    3072:vVpwQ/8KbV8nKet98UL0ZCN4CEgEamqlZbb25BF1ilZ:dpvOsZ6+tq3bi3FG

Score
10/10
njratdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc

    • Size

      165KB

    • MD5

      dfdec291a53f62834e81d192af2fb64e

    • SHA1

      959f8ffa233dd320b100258724adfe69b71144a5

    • SHA256

      5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc

    • SHA512

      e7560f6a230f37f18faf4876aae015e3e0050f0ea6f09a637e53cb559abbd020ec48e8e971f055641ecf8057e928493e1469ef56b1bfeede533bad48c95e23d9

    • SSDEEP

      3072:vVpwQ/8KbV8nKet98UL0ZCN4CEgEamqlZbb25BF1ilZ:dpvOsZ6+tq3bi3FG

    Score
    10/10
    njratdiscoverypersistencetrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks