Extracted

• • Target

    JaffaCakes118_4676c5fb478e0e5af4227433d41198d0

  • Size

    16KB

  • MD5

    4676c5fb478e0e5af4227433d41198d0

  • SHA1

    9de63d09f6fc0a044ebb425dd4d3dc08c3b6da80

  • SHA256

    3ef90c48e7cbc9caa234d8d8a3149ce72a9f3e471e2f24e3dba09264c09c3ec3

  • SHA512

    7cd13be3a0badf6179015378fc23d19c36d565c1671d3832389ac1168d8b4693f9b486258fde50c565f7e13f9ef6c1c91d03c8ae80abf20cf5d67b8abb7ce97f

  • SSDEEP

    384:Y3jrED137xiGg77do2LJvKeNMZzg5cks:3D5xiRZrLJvK2ls

  Score

  10^/10

  njrathackedevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2