Extracted

• • Target

    JaffaCakes118_000f45f0e74708e3b79e7dd0598c5d9b

  • Size

    121KB

  • MD5

    000f45f0e74708e3b79e7dd0598c5d9b

  • SHA1

    23a1d58a40d4d2e90b47e5303eead4a9c65a79e8

  • SHA256

    f3708be0f01799bf40ab729a335e3b689049b6017f2671fbf92bf2579de24595

  • SHA512

    aade94af175ee2500134584f22cf1dd87d73b9fabeec2dbce9f44d72d587bdd0a66f56a5d3edd889e70d3dd4d5d6597847ad9fbd1a4a67d8b5c2fd703bc6178b

  • SSDEEP

    3072:NPJQ1c9AXY7IQZyPPLs+dkPwDEJv1pp8hj:NGXYEXL1dkPWqppU

  Score

  10^/10

  njratneymar.jrevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2